Edit tour

Windows Analysis Report
ArenaWarsSetup.exe

Overview

General Information

Sample name:	ArenaWarsSetup.exe
Analysis ID:	1556375
MD5:	140cfcf356cc2da4d739c1cababbe7b4
SHA1:	d40acf2d6ec434aea3f9a5cc510efa093b793180
SHA256:	1c2eb5275c7212c7e578deef9f8b305a6623ef2d92f49f2eb9d517801bff0c02
Tags:	exeuser-likeastar20
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Drops large PE files

Tries to harvest and steal browser information (history, passwords, etc)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

ArenaWarsSetup.exe (PID: 6916 cmdline: "C:\Users\user\Desktop\ArenaWarsSetup.exe" MD5: 140CFCF356CC2DA4D739C1CABABBE7B4)

cmd.exe (PID: 3552 cmdline: cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq WarsArena.exe" | %SYSTEMROOT%\System32\find.exe "WarsArena.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2092 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq WarsArena.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 3100 cmdline: C:\Windows\System32\find.exe "WarsArena.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

WarsArena.exe (PID: 4860 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" MD5: CE6BE7DBF1189F24B294ABDFA9C10CB7)

cmd.exe (PID: 5256 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1364 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

WarsArena.exe (PID: 2284 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: CE6BE7DBF1189F24B294ABDFA9C10CB7)

WarsArena.exe (PID: 7008 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: CE6BE7DBF1189F24B294ABDFA9C10CB7)

chrome.exe (PID: 4196 cmdline: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1720,i,2144963780533695318,1306686769971395901,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7796 cmdline: "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8028 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5288 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8792 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7284 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7540 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7232 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7560 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7256 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7348 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7416 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7212 cmdline: taskkill /IM EpicGamesLauncher.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7492 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7512 cmdline: taskkill /IM javaw.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7436 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6736 cmdline: taskkill /f /im msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3356 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1304 cmdline: taskkill /f /im msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4104 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6884 cmdline: taskkill /f /im msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7876 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5568 cmdline: taskkill /IM Steam.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5880 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4724 cmdline: taskkill /f /im msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

WarsArena.exe (PID: 1464 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: CE6BE7DBF1189F24B294ABDFA9C10CB7)

cleanup

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400, CommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe, ParentProcessId: 4860, ParentProcessName: WarsArena.exe, ProcessCommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400, ProcessId: 4196, ProcessName: chrome.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: ArenaWarsSetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2dd41eeb-b697-51ce-bf35-97d7e100aa39

Jump to behavior

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt			Jump to behavior

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.9:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.9:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.9:49797 version: TLS 1.2

Source: ArenaWarsSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** is constructed during statement parsing and is held on Vdbe.pDblStr. source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1714868912.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: del /Q .exp .lo .ilk .lib .obj .ncb .pdb .sdf *.suo 2>NUL source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: CLEANFILES="$CLEANFILES .lib .dll .pdb .exp" source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1657504103.000000000517A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\PROGRAM FILES\NODEJS\NODE_MODULES\NPM\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: -typedil-fC:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\src\win_delay_load_hook.cc-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCMT.AMD64.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1656198864.000000000517A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: ArenaWarsSetup.exe, 00000000.00000003.1656198864.000000000517A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\electron.exe.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1669012719.0000000005174000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /OUT:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\HEXON\\.ELECTRON-GYP\\24.8.8\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: -FdC:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCPMT.AMD64.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0. source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 29MB

Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174
Source: Joe Sandbox View	IP Address: 108.181.20.35 108.181.20.35
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 72.145.3.21
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dMoBLy5pWN3hCbl&MD=pk6F5hZM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.48132e5427deb971ee28.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.c694729adaeead0f8ae0.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732268736&P2=404&P3=2&P4=l0WNFg%2fORbVyHUvDJDy2D9I7r9BIf7WmK%2fgyCQxPkXuGW6EnxkTtuDbbymPmSFhOMtHITQCeip9AykKsI1SxAw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: r5dl83tnQZmPWtOnUFvCA1Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dMoBLy5pWN3hCbl&MD=pk6F5hZM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: catbox.moe
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1085
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1452
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1512
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1637
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1936
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2046
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2152
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2273
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2894
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2978
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3027
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3045
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3246
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3682
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3729
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3997
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4214
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4267
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4646
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/482
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5469
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5577
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7527
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761Frontend
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://austingroupbugs.net/view.php?id=542
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.izs.me/)
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/smhasher/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/v8
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1094869
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/110263
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1144207
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1165751
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1171371
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1181068
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1181193
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/308366
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/403957
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/550292
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/565179
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642227
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642605
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/644669
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/650547
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/672380
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/709351
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/797243
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/809422
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/830046
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/849576
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/883276
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/927470
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/941620
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://devel.freebsoft.org/speechd
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/commonnode-set..
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedorahosted.org/lohit>
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedesktop.org
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.github.io/snappy/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxon
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: ArenaWarsSetup.exe, 00000000.00000003.1714868912.0000000002B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://int3.de/
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://nfs.sourceforge.net/#faq_a8
Source: ArenaWarsSetup.exe, 00000000.00000000.1462175627.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pages.citebite.com/v2o5n8l2f5reb))
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s..
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/compatibility)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sqlite.org/lockingv3.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1652714355.0000000007480000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/a/62888/10333
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tukaani.org/xz/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://valgrind.org
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://webkit.org/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat..
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1652714355.0000000007480000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chromium.org
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/coreutils/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jclark.com/xt
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nabble.com/SQLite-on-NFS-cache-coherency-td15655701.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/compile.html).
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.strongtalk.org/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.webrtc.org
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zlib.net/
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android-review.googlesource.com/#/c/115351/3/dist/sqlite3.c)
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android.com/pay
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4674
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4849
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5140
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5536
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7405
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3rpDuEX.
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3rpDuEX.WebBundleURLLoaderFactory::OnResponseParsedInvalid
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)ScriptProcessorHandler::ProcessScriptProcessorHandler::Process
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1072773
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.android.clients.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.bigcache.googleapis.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.docs.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.drive.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.googlesyndication.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.pack.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.play.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.youtube.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1712376081.000000000609C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: ArenaWarsSetup.exe, 00000000.00000003.1714868912.0000000002B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1038223.
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1042393
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1046462
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1060012
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1091824
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1137851
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.The
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908Changing
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1154140
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1300575
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1356053
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1393662).
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1412729
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/593024
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/619103.
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/619103.Subsequence
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/650547
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/655534
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/705865
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/710443
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/811661
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/848952
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119..
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/981419
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/blog/immutable-document-domain/
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#The_
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/android/guides/setup
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.org
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.orgExpired
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gcp.gvt2.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gcp.gvt6.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RyanZim/universalify.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aawc/unrar.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/andrewrk/node-mv/blob/master/package.json
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-styles?sponsor=1
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/distributed_point_functions
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ruy
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ukey2
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/woff2
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/xnnpack
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/node-glob/issues/167
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/node-glob/issues/205
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/323)).
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/pull/141
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-jsonfile#readfilefilename-options-callback).
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jprichardson/node-jsonfile#readfilesyncfilename-options).
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api#collaborators
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api/issues
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/27791
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/normalize/mz
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/isaacs
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/models
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/text.git
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.WindowPostMessageOptionstargetOriginhgMH
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wasdk/wasmparser
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimX
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLu
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLuThe
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType..
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/EuHzyv
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/HxfxSQ
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/J6ASzs
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22Media
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/rStTGz
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/xX8pDD
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/xX8pDDplay()
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/ximf56
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/ximf56Iframe
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-analytics.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/pay
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/payhttps://android.com/paysecure-payment-confirmationAppStoreBillingPlaceHolderZZ
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://googlevideo.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt1.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt2.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt6.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequentlyOut
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jimmy.warting.se/opensource
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/emoji
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/emoji-regex
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_exists_path_callback)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_existssync_path)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_read_fd_buffer_offset_length_position_callback)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_write_fd_buffer_offset_length_position_callback)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefile_file_data_options_callback)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefile_file_data_options_callback).
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefilesync_file_data_options)
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_fs_writefilesync_file_data_options).
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/util.html#util_util_promisify_original)
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0-headers.tar.gz
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gzhttps://nodejs.org/download/release
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/win-x64/node.lib
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://openjsf.org/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pagure.io/lohit
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billing
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billingQuota
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com
Source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com)
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/src/info/ff5be73dee
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1712376081.000000000609C000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714868912.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1712926204.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1712512419.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: ArenaWarsSetup.exe, 00000000.00000003.1712376081.000000000609C000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1712926204.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1712512419.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webrtc.googlesource.com/src/
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/343634942dd54ab
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/908f001483982c43
Source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/bba7b69f9849b5bf
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.swift.org/download/
Source: ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/copyright.html.
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.9:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.9:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.9:49797 version: TLS 1.2

Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE

memstr_acc6c2f2-6

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File dump: WarsArena.exe.0.dr 162117120			Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File dump: WarsArena.exe0.0.dr 162117120			Jump to dropped file

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

Process token adjusted: Security

Jump to behavior

Source: vulkan-1.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: WarsArena.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: WarsArena.exe0.0.dr	Static PE information: Number of sections : 15 > 10
Source: libEGL.dll0.0.dr	Static PE information: Number of sections : 11 > 10

Source: ArenaWarsSetup.exe, 00000000.00000003.1669012719.0000000005174000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1662023173.0000000006086000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibEGL.dllb! vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1656198864.000000000517A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1672617884.000000000517E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1662615132.0000000005175000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1714868912.0000000002B34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs ArenaWarsSetup.exe
Source: ArenaWarsSetup.exe, 00000000.00000003.1652421716.0000000006F80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs ArenaWarsSetup.exe

Source: ArenaWarsSetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.troj.spyw.winEXE@127/328@23/15

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_03
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\2dd41eeb-b697-51ce-bf35-97d7e100aa39
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

File created: C:\Users\user\AppData\Local\Temp\nsh476D.tmp

Jump to behavior

Source: ArenaWarsSetup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WARSARENA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EpicGamesLauncher.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "javaw.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Steam.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

File read: C:\Users\user\Desktop\ArenaWarsSetup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ArenaWarsSetup.exe "C:\Users\user\Desktop\ArenaWarsSetup.exe"
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq WarsArena.exe" \| %SYSTEMROOT%\System32\find.exe "WarsArena.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq WarsArena.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "WarsArena.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1720,i,2144963780533695318,1306686769971395901,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5288 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq WarsArena.exe" \| %SYSTEMROOT%\System32\find.exe "WarsArena.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq WarsArena.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "WarsArena.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1720,i,2144963780533695318,1306686769971395901,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5288 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2180,i,7403640353940489335,12822321588178167060,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: msmpeg2vdec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: msvproc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Section loaded: twinapi.appcore.dll

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq WarsArena.exe"

Source: Google Drive.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2dd41eeb-b697-51ce-bf35-97d7e100aa39

Jump to behavior

Source: ArenaWarsSetup.exe

Static file information: File size 86431523 > 1048576

Source: ArenaWarsSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** is constructed during statement parsing and is held on Vdbe.pDblStr. source: ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1714868912.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: del /Q .exp .lo .ilk .lib .obj .ncb .pdb .sdf *.suo 2>NUL source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: CLEANFILES="$CLEANFILES .lib .dll .pdb .exp" source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1657504103.000000000517A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\PROGRAM FILES\NODEJS\NODE_MODULES\NPM\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: -typedil-fC:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\src\win_delay_load_hook.cc-dos-Zi-Z7-W3-pdbrpc-Og-Ob2-Ot-EHs-MT-GS-Gy-FitObjFunc-FitObjData-NoRTTI-FoC:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\deps\Release\obj\sqlite3\win_delay_load_hook.obj-FdC:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb-errorreport:queue source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCMT.AMD64.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1656198864.000000000517A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: ArenaWarsSetup.exe, 00000000.00000003.1656198864.000000000517A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\electron.exe.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1669012719.0000000005174000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /OUT:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\HEXON\\.ELECTRON-GYP\\24.8.8\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: -FdC:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCPMT.AMD64.PDB source: ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0. source: ArenaWarsSetup.exe, 00000000.00000003.1565299065.0000000006780000.00000004.00001000.00020000.00000000.sdmp

Source: WarsArena.exe.0.dr	Static PE information: section name: .00cfg
Source: WarsArena.exe.0.dr	Static PE information: section name: .gxfg
Source: WarsArena.exe.0.dr	Static PE information: section name: .retplne
Source: WarsArena.exe.0.dr	Static PE information: section name: .rodata
Source: WarsArena.exe.0.dr	Static PE information: section name: CPADinfo
Source: WarsArena.exe.0.dr	Static PE information: section name: LZMADEC
Source: WarsArena.exe.0.dr	Static PE information: section name: _RDATA
Source: WarsArena.exe.0.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: WarsArena.exe0.0.dr	Static PE information: section name: .00cfg
Source: WarsArena.exe0.0.dr	Static PE information: section name: .gxfg
Source: WarsArena.exe0.0.dr	Static PE information: section name: .retplne
Source: WarsArena.exe0.0.dr	Static PE information: section name: .rodata
Source: WarsArena.exe0.0.dr	Static PE information: section name: CPADinfo
Source: WarsArena.exe0.0.dr	Static PE information: section name: LZMADEC
Source: WarsArena.exe0.0.dr	Static PE information: section name: _RDATA
Source: WarsArena.exe0.0.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll0.0.dr	Static PE information: section name: _RDATA
Source: 59771852-3ee7-40a8-9131-cde20a2f173b.tmp.node.7.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File created: C:\Users\user\AppData\Local\Temp\59771852-3ee7-40a8-9131-cde20a2f173b.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File created: C:\Users\user\AppData\Local\Temp\6d6fc5d8-dfab-4714-a1de-1d7cc7399eb2.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\WarsArena.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File created: C:\Users\user\AppData\Local\Temp\59771852-3ee7-40a8-9131-cde20a2f173b.tmp.node			Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File created: C:\Users\user\AppData\Local\Temp\6d6fc5d8-dfab-4714-a1de-1d7cc7399eb2.tmp.node			Jump to dropped file

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt			Jump to behavior

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarsArena.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\59771852-3ee7-40a8-9131-cde20a2f173b.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6d6fc5d8-dfab-4714-a1de-1d7cc7399eb2.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\resources\elevate.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\unrealgame FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\unrealgame FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File Volume queried: C:\Users\user FullSizeInformation

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Jump to behavior

Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestX
Source: ArenaWarsSetup.exe, 00000000.00000003.1657504103.000000000517A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliT8xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliG31OrOlder(functions))
Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: ArenaWarsSetup.exe, 00000000.00000003.1657504103.000000000517A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ArenaWarsSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq WarsArena.exe" \| %SYSTEMROOT%\System32\find.exe "WarsArena.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq WarsArena.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "WarsArena.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im msedge.exe

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "c:\users\user\appdata\local\programs\unrealgame\warsarena.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "c:\users\user\appdata\local\programs\unrealgame\warsarena.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "c:\users\user\appdata\local\programs\unrealgame\warsarena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2604 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "c:\users\user\appdata\local\programs\unrealgame\warsarena.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "c:\users\user\appdata\local\programs\unrealgame\warsarena.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe "c:\users\user\appdata\local\programs\unrealgame\warsarena.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2604 --field-trial-handle=1840,i,9929463779413634809,13704323486948710207,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior

Source: ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTimeWindowCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableCompositionScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failed..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_magnifier.ccMagnifier initialization failed.Magnifier capturer failed to capture a frame.WebRTC.DesktopCapture.Win.MagnifierCapturerFrameTimeCaptureImageFailed to call SetWindowPos: . Rect = {Failed to call MagSetWindowSource: InitializeMagnifierMagnifier capturer cannot work on multi-screen system.Magnification.dllMagInitializeMagUninitializeMagSetWindowSourceMagSetWindowFilterListMagSetImageScalingCallbackFailed to initialize ScreenCapturerWinMagnifier: library functions missing.Failed to initialize ScreenCapturerWinMagnifier: error from MagInitialize Failed to initialize ScreenCapturerWinMagnifier: error from GetModulehandleExA Failed to initialize ScreenCapturerWinMagnifier: error from creating host window Failed to initialize ScreenCapturerWinMagnifier: error from creating magnifier window Failed to initialize ScreenCapturerWinMagnifier: error from MagSetImageScalingCallback Failed to initialize ScreenCapturerWinMagnifier: error from MagSetWindowFilterList OnCapturedOutput format does not match the captured format: width = , height = , stride = , bpp = , pixel format RGBA ? ..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccCreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\unrealgame VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\unrealgame\resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\unrealgame\resources\app.asar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hbmxntqzkji0.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\passwords_0.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\passwords_36.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Variations VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\WidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\AppData\Roaming\All_Wallets.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Disable or Modify Tools	11 Input Capture	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Data from Local System	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Extra Window Memory Injection	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\59771852-3ee7-40a8-9131-cde20a2f173b.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6d6fc5d8-dfab-4714-a1de-1d7cc7399eb2.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\WarsArena.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd4888.tmp\nsis7z.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
catbox.moe	108.181.20.35	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	142.250.186.132	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.48132e5427deb971ee28.js	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

Name	Source	Malicious	Reputation
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/isaacs/node-glob/issues/205	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://support.google.com/chrome/answer/6098869	ArenaWarsSetup.exe, 00000000.00000003.1712376081.000000000609C000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1712926204.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1712512419.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.bluetooth.com/specifications/gatt/services	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/4633	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://anglebug.com/7382	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/mathiasbynens/emoji-regex.git	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.gnu.org/software/coreutils/	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.chromestatus.com/feature/5093566007214080	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://goo.gl/7K7WLuThe	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.google.com/	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://crbug.com/1356053	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://goo.gl/7K7WLu	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crbug.com/110263	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/jprichardson/node-jsonfile#readfilesyncfilename-options).	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/6929	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://openjsf.org/	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chromium.googlesource.com/chromium/src/	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
http://sqlite.org/lockingv3.html	ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	false	high
https://anglebug.com/7246	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://anglebug.com/7369	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://anglebug.com/7489	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://bit.ly/3rpDuEX.	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://crbug.com/593024	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://w3c.github.io/manifest/#installability-signals	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://exslt.org/common	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/models	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://c.docs.google.com/	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/KhronosGroup/SPIRV-Headers.git	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.sqlite.org/src/info/908f001483982c43	ArenaWarsSetup.exe, 00000000.00000003.1564979656.0000000005870000.00000004.00001000.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/161903006	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://crbug.com/1300575	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.nongnu.org/freebangfont/downloads.html#mukti	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://crbug.com/710443	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/tflite-support	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sqlite.org/	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://crbug.com/1060012	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3997	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/4722	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crbug.com/642605	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/1452	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://crbug.com/650547callClearTwiceUsing	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://html4/loose.dtd	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3502	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3623	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://gitlab.freedesktop.org/xdg/xdgmime	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anglebug.com/3625	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3624	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://beacons.gcp.gvt2.com/domainreliability/upload	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/2894	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3862	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/RyanZim/universalify.git	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/4836	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/issues/166475273	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/wasdk/wasmparser	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/sponsors/isaacs	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3970	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://dejavu-fonts.github.io/Download.html	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pagure.io/lohit	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006780000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.jpg	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://android.com/pay	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/5901	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://nodejs.org/en/docs/inspectorFor	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	false	high
https://xhr.spec.whatwg.org/.	ArenaWarsSetup.exe, 00000000.00000003.1650449988.0000000006A02000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3965	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://anglebug.com/7161	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/web-animations/web-animations-js	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.chromestatus.com/feature/6662647093133312	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>	ArenaWarsSetup.exe, 00000000.00000003.1664454922.0000000005172000.00000004.00000020.00020000.00000000.sdmp	false	high
https://anglebug.com/7162	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3729	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://sindresorhus.com	ArenaWarsSetup.exe, 00000000.00000003.1564271771.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1714718816.0000000005173000.00000004.00000020.00020000.00000000.sdmp, ArenaWarsSetup.exe, 00000000.00000003.1565706034.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/5906	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crbug.com/830046	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/2517	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/4937	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://crbug.com/1144908	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/166809097	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crbug.com/672380	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://goo.gl/EuHzyv	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
http://anglebug.com/3832	ArenaWarsSetup.exe, 00000000.00000003.1575121546.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://beacons4.gvt2.com/domainreliability/upload	ArenaWarsSetup.exe, 00000000.00000003.1651275862.0000000006B80000.00000004.00001000.00020000.00000000.sdmp	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.181.20.35	catbox.moe	Canada	852	ASN852CA	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
72.145.3.21	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.115.132	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556375
Start date and time:	2024-11-15 10:43:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	64
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ArenaWarsSetup.exe
Detection:	MAL
Classification:	mal56.troj.spyw.winEXE@127/328@23/15
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.25.227.174	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	test.exe	Get hash	malicious	Babadeda	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Riskware.OfferCore.702.11507.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse
108.181.20.35	Document.pdf.lnk	Get hash	malicious	Unknown	Browse	files.catbox.moe/p1yr9i.pdf
108.181.20.35	SecuriteInfo.com.HEUR.Trojan.OLE2.Agent.gen.26943.12401.msi	Get hash	malicious	LummaC Stealer	Browse	files.catbox.moe/nzct1p
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	52.98.227.242
	https://www.google.dk/url?sa=https://abc123xyz456def789ghj101klm112nop345qrs678tuv901wxyz234abc567d&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiX6tO39MiJAxUSnP0HHcggDNwQFnoECBoQAQ&url=amp%2F%62%68%61%72%61%74%68%73%65%72%76%69%63%65%73%69%6E%64%69%61%2E%63%6F%6D%2F%75%6E%73%75%62%73%63%72%69%62%65%2Fab86aa851e981834b77805f77a6cca34%2Fcm9yeWdvd2VyQHF1YW50ZXhhLmNvbQ==&token=fgj784jkh23&referrerID=xyz456789&sessionKey=abc123456789&trackingID=klmn987654&clickID=7890abcd1234&userID=xyz901234&pageID=web23456789	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://www.cognitoforms.com/f/QJDkMg1ACkylvn0c20THNA/1	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?	Get hash	malicious	Unknown	Browse	40.101.138.2
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
ASN852CA	xd.spc.elf	Get hash	malicious	Mirai	Browse	142.169.14.239
	mips.elf	Get hash	malicious	Mirai	Browse	161.19.241.167
	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	209.53.104.227
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse	108.181.20.35
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse	108.181.20.35
	https://files.catbox.moe/iz3lne.zip	Get hash	malicious	Unknown	Browse	108.181.20.35
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	108.181.20.35
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	108.181.20.35
CLOUDFLARENETUS	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	172.67.151.164
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.html	Get hash	malicious	Unknown	Browse	104.16.123.96
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
EDGECASTUS	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://www.google.dk/url?sa=https://abc123xyz456def789ghj101klm112nop345qrs678tuv901wxyz234abc567d&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiX6tO39MiJAxUSnP0HHcggDNwQFnoECBoQAQ&url=amp%2F%62%68%61%72%61%74%68%73%65%72%76%69%63%65%73%69%6E%64%69%61%2E%63%6F%6D%2F%75%6E%73%75%62%73%63%72%69%62%65%2Fab86aa851e981834b77805f77a6cca34%2Fcm9yeWdvd2VyQHF1YW50ZXhhLmNvbQ==&token=fgj784jkh23&referrerID=xyz456789&sessionKey=abc123456789&trackingID=klmn987654&clickID=7890abcd1234&userID=xyz901234&pageID=web23456789	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPU5IRjVZVzA9JnVpZD1VU0VSMTcxMDIwMjRVMTgxMDE3MjE=N0123N	Get hash	malicious	Mamba2FA	Browse	152.199.21.175
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fmyarrowleaf1-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fmarge_penrod_myarrowleaf_org%2FElQV40bjfBZKivPSKIPxGuYBa20TAVuQG9ya4YrQRKjHiQ%3Fe%3D7nML8f&data=eJxVzctugzAQBdCvMbtGBqOkWXhBlOYhUiW0VaR0gyZgGyL80Ng05e8L6aaVZlZz7p2Kz5PlPI1BxBQqFtW8qkF14P2ssjrSfEEPxukjHONsHXlusRboSUrN_aG0VA-IPFyxVU0QOB7_dfS8CcF5wjKSbMbRAyDaeydAxk96mPkGUDjbmjDxybBM_mo1rhv_WQPdlARUonTCoK3LPzWlxUm-dMU5pdebXH3m7dfpPd-fvrf9ZQUJ_cjOfbFdDpBesHjLb7u2IGwjCFsvzOvhWf4A0NhYxQ%25%25	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://share.hsforms.com/13Dqwfz0LRkK1qoBQuRdgjgsnbj9	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://loop.net.pk/cos.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	https://forms.office.com/Pages/ShareFormPage.aspx?id=xW69F1aTs06UvACEsnZeONWs3ov4-fZJk9ZDjpIIN5tUMUFMSUpJVVFUWEtHTFlURVNUWE1QV1hXQi4u&sharetoken=2Z2A4vYPJAA4bBGx5zDg	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.31.73
	tmp8EC6.HTmL.html	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.31.73
	NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.html	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.31.73
	https://incomestatementsaau.de/Secured_shared_invoice%25PdsD$f%253vt7674/	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.31.73
	https://www.google.dk/url?sa=https://abc123xyz456def789ghj101klm112nop345qrs678tuv901wxyz234abc567d&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiX6tO39MiJAxUSnP0HHcggDNwQFnoECBoQAQ&url=amp%2F%62%68%61%72%61%74%68%73%65%72%76%69%63%65%73%69%6E%64%69%61%2E%63%6F%6D%2F%75%6E%73%75%62%73%63%72%69%62%65%2Fab86aa851e981834b77805f77a6cca34%2Fcm9yeWdvd2VyQHF1YW50ZXhhLmNvbQ==&token=fgj784jkh23&referrerID=xyz456789&sessionKey=abc123456789&trackingID=klmn987654&clickID=7890abcd1234&userID=xyz901234&pageID=web23456789	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	20.109.210.53 40.126.31.73
	https://www.cognitoforms.com/f/QJDkMg1ACkylvn0c20THNA/1	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.31.73
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 40.126.31.73
	BankInformation.vbe	Get hash	malicious	AgentTesla	Browse	20.109.210.53 40.126.31.73
	https://microsoft-outlook-microsoft-outlook.chicken10.com.br/?no=Y2hyaXN0b3BoZS50aWJlcmdoaWVuQGRhaWljaGktc2Fua3lvLmZy$	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.31.73

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\WarsArena.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.01264908944072593
Encrypted:	false
SSDEEP:	3:wolGlll/l/lXp9ZjrPBY0GlAl/SxrP:wo0dPBY0yAIN
MD5:	0685D8086D2E1B3FF4BB5E31BD8323E6
SHA1:	463A551AD9DE9D6FEB31A4AC9B97C1C2644E2707
SHA-256:	AA57E6F6DCEF94EB2FF468DD28D2CD31A918DADD90EA82FD265331599452FFA2
SHA-512:	F658B1A5355D78C5A532EF4343AC27241E1F7020B196D386A74391EC5FE2794DAE67B67CBED53A6FE360F048908EB8CCC967E32D6C530FC3D6FC36BC7FEAFD02
Malicious:	false
Preview:	.t..........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.10166998551495
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynGCBS2qX7bgtPHgorQXdbiR3oM:z/0+zI7ynGkS20wtP0Xdbe3
MD5:	BE8ED380B27F2567BEAD212DBCC4A932
SHA1:	3F334E950206A50BE0E22DA58C5C53D124376581
SHA-256:	E25279E1808542E977A4ABD29C98B19ABA43BA2E5291DE881C4B0AEA3B1340F8
SHA-512:	3685A1F410B0C6899A679BB54A55E7078D44E9F0BC923B0AA84E2FB0B0604966C67E7CF8BA08ECC29CD1C1570271838FCCED216CE58658AA2454FDF93C858778
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Process:	C:\Users\user\Desktop\ArenaWarsSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 08:45:30 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9733446713046727
Encrypted:	false
SSDEEP:	48:8EdoToNH7idAKZdA1P4ehwiZUklqehjy+3:8HEvOoy
MD5:	D8B1C588B87729C920777B114AE7538A
SHA1:	2D6D2E3F2CC97B9925769F963491BDDCBD23288A
SHA-256:	92BDD9D32CC3219639D49F083BBCAEB655F982466BA4B865C510CF7EC3E3F01C
SHA-512:	821887A547BC19F9E22B3F14A13C435397CA44D826753DA42A590B18E2AB056382037DA9A81104229253B7867E58767995F9810451C9DD3B902B13ABFC179B2B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....=...C7....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IoY.M....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.M....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VoY.M....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VoY.M.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VoY.M...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999983986254452
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ArenaWarsSetup.exe
File size:	86'431'523 bytes
MD5:	140cfcf356cc2da4d739c1cababbe7b4
SHA1:	d40acf2d6ec434aea3f9a5cc510efa093b793180
SHA256:	1c2eb5275c7212c7e578deef9f8b305a6623ef2d92f49f2eb9d517801bff0c02
SHA512:	3beb1f67f91760856257d49038320bcfd352e1a1570422e60430d67da858ef0c2b6873c07297f55ddb8a253e560974d93cb3ab237f500baa733950cad3d8bc3f
SSDEEP:	1572864:qDJ39Kk9MTMh5/pCy5sbB8ceyIS7nqYdd6hIEhSmn6nlN/fFj:qWk9MT2/Uyyb/vP7nMhJnUXfN
TLSH:	57183348F20A5B69D213B9F1FBB4B4B5C9D0B2847CD3D0F26B642A86991CB117F524CB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x5970	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x5970	0x5a00	c0bbe6e0c3ab15aa4e0b896fa7f7ef89	False	0.49518229166666666	data	5.454346267886394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f5c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7213883677298312
RT_ICON	0x1a0670	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6751066098081023
RT_ICON	0x1a1518	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7851985559566786
RT_ICON	0x1a1dc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.6560693641618497
RT_ICON	0x1a2328	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8031914893617021
RT_ICON	0x1a2790	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3118279569892473
RT_ICON	0x1a2a78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36824324324324326
RT_DIALOG	0x1a2ba0	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1a2da8	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1a2ea0	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1a2f90	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1a3190	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1a3280	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1a3368	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1a3558	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1a3640	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1a3720	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1a3910	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1a39f8	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1a3ad8	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1a3cd0	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1a3db8	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1a3e98	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1a40a0	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1a4198	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1a4288	0x68	data	English	United States	0.6634615384615384
RT_VERSION	0x1a42f0	0x254	data	English	United States	0.47818791946308725
RT_MANIFEST	0x1a4548	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ArenaWarsSetup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\695072c26b7e46cc\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\695072c26b7e46cc\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\695072c26b7e46cc\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3e81dde0-8a40-467b-82f5-067c4fb5c31a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6d8a3083-ce96-4b40-b170-fdaf9b2088ca.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4effabd4-93d4-4515-a3c7-ec0cd2c05963.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6737183B-1E74.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\52120945-29fc-4db1-be95-5b4294d7fa80.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\84d63e76-a65e-467c-9edd-c0bac289bc9a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\87ac9688-89e4-4502-8ecd-a222a67392d9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Windows Analysis Report
ArenaWarsSetup.exe

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 10:45:25.916549921 CET	192.168.2.9	1.1.1.1	0x32eb	Standard query (0)	catbox.moe	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:29.142690897 CET	192.168.2.9	1.1.1.1	0x3258	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:29.143055916 CET	192.168.2.9	1.1.1.1	0x1608	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:33.318558931 CET	192.168.2.9	1.1.1.1	0xa964	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:33.319010973 CET	192.168.2.9	1.1.1.1	0x895f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:33.921143055 CET	192.168.2.9	1.1.1.1	0x282d	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:33.921355963 CET	192.168.2.9	1.1.1.1	0xc2e8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:35.113909960 CET	192.168.2.9	1.1.1.1	0x5960	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:35.114146948 CET	192.168.2.9	1.1.1.1	0x6ca0	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 15, 2024 10:45:38.583503962 CET	192.168.2.9	1.1.1.1	0x998b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.583648920 CET	192.168.2.9	1.1.1.1	0xdbb4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:38.584280014 CET	192.168.2.9	1.1.1.1	0xb186	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.584639072 CET	192.168.2.9	1.1.1.1	0xd85	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:38.787631035 CET	192.168.2.9	1.1.1.1	0x9eeb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.788304090 CET	192.168.2.9	1.1.1.1	0x579a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:39.141495943 CET	192.168.2.9	1.1.1.1	0x8b30	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.141735077 CET	192.168.2.9	1.1.1.1	0xe177	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:39.163090944 CET	192.168.2.9	1.1.1.1	0x5a74	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.163278103 CET	192.168.2.9	1.1.1.1	0xf3b3	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:39.164014101 CET	192.168.2.9	1.1.1.1	0xccb9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.164148092 CET	192.168.2.9	1.1.1.1	0x47f	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 15, 2024 10:45:39.173727989 CET	192.168.2.9	1.1.1.1	0xf09e	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.173858881 CET	192.168.2.9	1.1.1.1	0x2723	Standard query (0)	c.msn.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 10:45:25.928436041 CET	1.1.1.1	192.168.2.9	0x32eb	No error (0)	catbox.moe		108.181.20.35	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:29.155405045 CET	1.1.1.1	192.168.2.9	0x3258	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:29.155415058 CET	1.1.1.1	192.168.2.9	0x1608	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 10:45:33.325603962 CET	1.1.1.1	192.168.2.9	0xa964	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:33.325603962 CET	1.1.1.1	192.168.2.9	0xa964	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:33.326100111 CET	1.1.1.1	192.168.2.9	0x895f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 10:45:33.928400040 CET	1.1.1.1	192.168.2.9	0xc2e8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:33.928474903 CET	1.1.1.1	192.168.2.9	0x282d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:33.929893970 CET	1.1.1.1	192.168.2.9	0x68ce	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:33.930680990 CET	1.1.1.1	192.168.2.9	0xb2b8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:33.930680990 CET	1.1.1.1	192.168.2.9	0xb2b8	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:35.121283054 CET	1.1.1.1	192.168.2.9	0x6ca0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:35.121381998 CET	1.1.1.1	192.168.2.9	0x5960	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:36.782274008 CET	1.1.1.1	192.168.2.9	0xcd86	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:36.782274008 CET	1.1.1.1	192.168.2.9	0xcd86	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:36.782313108 CET	1.1.1.1	192.168.2.9	0x1098	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:38.590369940 CET	1.1.1.1	192.168.2.9	0xdbb4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 10:45:38.590393066 CET	1.1.1.1	192.168.2.9	0x998b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.590393066 CET	1.1.1.1	192.168.2.9	0x998b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.591214895 CET	1.1.1.1	192.168.2.9	0xb186	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.591214895 CET	1.1.1.1	192.168.2.9	0xb186	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.591640949 CET	1.1.1.1	192.168.2.9	0xd85	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 10:45:38.794409990 CET	1.1.1.1	192.168.2.9	0x9eeb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.794409990 CET	1.1.1.1	192.168.2.9	0x9eeb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:38.795141935 CET	1.1.1.1	192.168.2.9	0x579a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 10:45:39.148350000 CET	1.1.1.1	192.168.2.9	0x8b30	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.148350000 CET	1.1.1.1	192.168.2.9	0x8b30	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.148350000 CET	1.1.1.1	192.168.2.9	0x8b30	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.148350000 CET	1.1.1.1	192.168.2.9	0x8b30	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:45:39.169851065 CET	1.1.1.1	192.168.2.9	0x5a74	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:39.169934988 CET	1.1.1.1	192.168.2.9	0xf3b3	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:39.170660019 CET	1.1.1.1	192.168.2.9	0xccb9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:39.171253920 CET	1.1.1.1	192.168.2.9	0x47f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:39.180944920 CET	1.1.1.1	192.168.2.9	0xf09e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 10:45:39.181649923 CET	1.1.1.1	192.168.2.9	0x2723	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:07 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dMoBLy5pWN3hCbl&MD=pk6F5hZM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-15 09:45:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6aae409e-1222-43e7-bd93-3cb95c9ef851 MS-RequestId: f493b1cf-8a95-45bf-8dff-5746ac40d446 MS-CV: Vwiv6trHc0C/nIB3.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 09:45:06 GMT Connection: close Content-Length: 24490
2024-11-15 09:45:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-15 09:45:07 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:30 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 09:45:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 09:45:30 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-NlBFdLflKT6IaD9MoSrMLg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 09:45:30 UTC	112	IN	Data Raw: 39 30 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 74 61 72 64 65 77 20 76 61 6c 6c 65 79 20 70 61 74 63 68 20 75 70 64 61 74 65 22 2c 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 70 68 69 6c 6c 69 65 73 22 2c 22 65 6d 69 6c 69 61 20 70 65 72 65 7a 20 6e 65 74 66 6c 69 78 22 2c 22 66 62 69 20 69 6e 76 65 73 74 69 67 61 74 69 6f 6e 20 69 Data Ascii: 908)]}'["",["stardew valley patch update","philadelphia phillies","emilia perez netflix","fbi investigation i
2024-11-15 09:45:30 UTC	1378	IN	Data Raw: 6e 20 70 6f 72 74 6c 61 6e 64 20 63 74 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 20 68 75 72 72 69 63 61 6e 65 20 73 61 72 61 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 62 75 72 67 65 72 20 6b 69 6e 67 20 66 72 69 65 64 20 70 69 63 6b 6c 65 20 66 72 69 65 73 22 2c 22 6d 79 20 63 68 65 6d 69 63 61 6c 20 72 6f 6d 61 6e 63 65 20 62 6c 61 63 6b 20 70 61 72 61 64 65 20 74 6f 75 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 Data Ascii: n portland ct","tropical storm hurricane sara","aurora borealis northern lights forecast","burger king fried pickle fries","my chemical romance black parade tour"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsi
2024-11-15 09:45:30 UTC	829	IN	Data Raw: 72 52 79 74 44 65 44 4e 6f 62 47 4e 6e 55 46 42 47 4d 54 51 34 52 46 4a 32 51 6e 5a 7a 55 57 6c 6e 59 6a 6c 6d 59 57 74 6f 55 46 46 59 4f 45 56 57 64 6d 70 59 51 57 46 53 4f 57 31 4f 64 30 68 34 61 6d 78 6c 51 6d 52 6e 55 46 45 72 55 6a 68 30 59 30 56 45 61 58 5a 59 56 79 39 6e 52 69 39 42 4c 33 64 6d 5a 30 6c 49 4f 45 64 42 53 7a 42 53 59 6b 46 48 51 57 5a 31 54 47 56 42 52 45 4a 51 59 6b 4a 7a 51 55 6c 49 4f 45 64 46 54 32 46 61 54 31 4a 36 64 31 51 77 52 7a 6c 6f 5a 47 4a 45 4e 47 31 49 4e 43 39 36 59 6a 64 4e 52 6b 68 36 4d 57 31 46 4e 32 35 4f 63 32 78 36 52 33 5a 49 55 48 4a 70 61 57 30 79 4f 48 64 6f 64 6c 4e 36 63 44 52 33 65 6c 6c 34 63 54 68 42 51 31 67 79 55 48 5a 74 4e 30 78 59 4e 6a 46 71 4f 54 46 59 53 6e 4e 72 4e 6a 68 79 64 58 4a 4d 61 56 Data Ascii: rRytDeDNobGNnUFBGMTQ4RFJ2QnZzUWlnYjlmYWtoUFFYOEVWdmpYQWFSOW1Od0h4amxlQmRnUFErUjh0Y0VEaXZYVy9nRi9BL3dmZ0lIOEdBSzBSYkFHQWZ1TGVBREJQYkJzQUlIOEdFT2FaT1J6d1QwRzloZGJENG1INC96YjdNRkh6MW1FN25Oc2x6R3ZIUHJpaW0yOHdodlN6cDR3ell4cThBQ1gyUHZtN0xYNjFqOTFYSnNrNjhydXJMaV
2024-11-15 09:45:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:30 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlKHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 09:45:31 UTC	1018	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 09:45:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 09:45:31 UTC	360	IN	Data Raw: 32 33 34 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 234c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 37 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700317,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"thi
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 Data Ascii: 03dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u
2024-11-15 09:45:31 UTC	416	IN	Data Raw: 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 Data Ascii: ateScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\u003d_.b
2024-11-15 09:45:31 UTC	438	IN	Data Raw: 31 61 66 0d 0a 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 Data Ascii: 1af(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.ee\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfu
2024-11-15 09:45:31 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 67 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 55 64 5c 75 30 30 33 64 5f 2e 4d 64 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 61 65 5c 75 30 30 33 64 2f Data Ascii: 8000){return _.vb(_.ge(a,b),c)};_.he\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.je\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Ud\u003d_.Md;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};ae\u003d/

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:30 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 09:45:31 UTC	933	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 09:45:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 09:45:31 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-15 09:45:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-15 09:45:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-15 09:45:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 15 Nov 2024 09:45:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e2e4f2468f66b71-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 09:45:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 89 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:35 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 09:45:35 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 15 Nov 2024 09:45:34 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 09:45:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 09:45:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 09:44:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_SN1 x-ms-request-id: ac736d43-e17f-471b-8516-c8968c883447 PPServer: PPV: 30 H: SN1PEPF0002F0B4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 09:45:35 GMT Connection: close Content-Length: 11392
2024-11-15 09:45:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:45:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-15 09:45:37 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 09:45:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 09:44:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_BAY x-ms-request-id: 64874a5f-e4ef-4827-9c38-0d892ada9c13 PPServer: PPV: 30 H: PH1PEPF0001B813 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 09:45:37 GMT Connection: close Content-Length: 11412
2024-11-15 09:45:38 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200