Just a heads-up to the dev — I checked the latest version of the game offline and found some weird stuff.
There’s a file sitting in the Temp folder (Crashpad-related) that already exists before the game crashes. Inside? It’s got a full Chrome-style autofill schema — name_on_card, expiration_month, guid, the whole thing. Doesn’t look like a legit crash log — more like it was pre-staged.
After a crash, I saw:
Registry edits to FeatureUsage\AppModel\SystemAppData, BLBeacon, and Control\BAM\UserSettings
Fake Chrome extension data, session tokens, and spoofed Preferences MACs in NW.js local storage (LevelDB / IndexedDB)
I used ProcMon, Wireshark, System Informer, and PEStudio during the analysis. No network activity happened since it was fully offline, but the behavior looks like it’s set to activate once a connection is available.
Also, PEStudio flagged multiple kernel-level calls and 5+ callbacks embedded in the executable — not typical for a regular game. Makes it look more like it's hooking into the system at a deeper level.
Could be a packaging issue or something hidden in the runtime — just thought you’d want to know. I’ve got logs, crash contents, registry diffs, and snapshots if you want to take a look.
Really good game and much love <3, but should only be ran in a VM until the dev fix this.
There’s a file sitting in the Temp folder (Crashpad-related) that already exists before the game crashes. Inside? It’s got a full Chrome-style autofill schema — name_on_card, expiration_month, guid, the whole thing. Doesn’t look like a legit crash log — more like it was pre-staged.
After a crash, I saw:
Registry edits to FeatureUsage\AppModel\SystemAppData, BLBeacon, and Control\BAM\UserSettings
Fake Chrome extension data, session tokens, and spoofed Preferences MACs in NW.js local storage (LevelDB / IndexedDB)
I used ProcMon, Wireshark, System Informer, and PEStudio during the analysis. No network activity happened since it was fully offline, but the behavior looks like it’s set to activate once a connection is available.
Also, PEStudio flagged multiple kernel-level calls and 5+ callbacks embedded in the executable — not typical for a regular game. Makes it look more like it's hooking into the system at a deeper level.
Could be a packaging issue or something hidden in the runtime — just thought you’d want to know. I’ve got logs, crash contents, registry diffs, and snapshots if you want to take a look.
Really good game and much love <3, but should only be ran in a VM until the dev fix this.
Last edited: