hxxps://download2354[.]mediafire[.]com/67l6jyb16otgFVgrzI5l1qNtgzcDzvUVAaPeSnf-ja4kHSxl_6B7oB3xaM9EIxb0fjW_KqkVmN1Uu7U5N88WyJSaMOrP-izGkNkRD0yJgXb3qXnESWHlAj9edyUBEPCPDacc4DIFEsv2H0pUQE9AcVtiiqgbIH7MhS9Bb4sqsZA/8flnjugjj8s12p5/WorldBox[.]God[.]Simulator[.]Build[.]11538132[.]zip

Analysis

max time kernel
301s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download2354.mediafire.com/67l6jyb16otgFVgrzI5l1qNtgzcDzvUVAaPeSnf-ja4kHSxl_6B7oB3xaM9EIxb0fjW_KqkVmN1Uu7U5N88WyJSaMOrP-izGkNkRD0yJgXb3qXnESWHlAj9edyUBEPCPDacc4DIFEsv2H0pUQE9AcVtiiqgbIH7MhS9Bb4sqsZA/8flnjugjj8s12p5/WorldBox.God.Simulator.Build.11538132.zip

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	worldbox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	worldbox.exe
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	worldbox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	worldbox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	worldbox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	worldbox.exe
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	worldbox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	worldbox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522421018365004"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1488	chrome.exe
1488	chrome.exe
3016	chrome.exe
3016	chrome.exe
2236	worldbox.exe
2236	worldbox.exe
760	UnityCrashHandler64.exe
760	UnityCrashHandler64.exe
760	UnityCrashHandler64.exe
760	UnityCrashHandler64.exe
996	worldbox.exe
996	worldbox.exe
4020	UnityCrashHandler64.exe
4020	UnityCrashHandler64.exe
4020	UnityCrashHandler64.exe
4020	UnityCrashHandler64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1488	chrome.exe
1488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe
Token: SeShutdownPrivilege	1488	chrome.exe
Token: SeCreatePagefilePrivilege	1488	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe
1488	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2236	worldbox.exe
996	worldbox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1952	1488	chrome.exe	83
PID 1488 wrote to memory of 1952	1488	chrome.exe	83
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 3244	1488	chrome.exe	85
PID 1488 wrote to memory of 4336	1488	chrome.exe	87
PID 1488 wrote to memory of 4336	1488	chrome.exe	87
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86
PID 1488 wrote to memory of 4544	1488	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download2354.mediafire.com/67l6jyb16otgFVgrzI5l1qNtgzcDzvUVAaPeSnf-ja4kHSxl_6B7oB3xaM9EIxb0fjW_KqkVmN1Uu7U5N88WyJSaMOrP-izGkNkRD0yJgXb3qXnESWHlAj9edyUBEPCPDacc4DIFEsv2H0pUQE9AcVtiiqgbIH7MhS9Bb4sqsZA/8flnjugjj8s12p5/WorldBox.God.Simulator.Build.11538132.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd83069758,0x7ffd83069768,0x7ffd83069778
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:2
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2768 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2776 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6068 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 --field-trial-handle=1864,i,13733911247116386586,16639060781966761680,131072 /prefetch:8
  2⤵
  PID:2368

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4904

C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\worldbox.exe
"C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\worldbox.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2236
- C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe" --attach 2236 2441016643584
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- - C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe" "2236" "2441016643584"
    3⤵
    PID:2500

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4f4
1⤵
PID:620

C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\worldbox.exe
"C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\worldbox.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:996
- C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe" --attach 996 2232189652992
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- - C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\WorldBox.God.Simulator.Build.11538132\WorldBox.God.Simulator.Build.11538132\UnityCrashHandler64.exe" "996" "2232189652992"
    3⤵
    PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
b890e309be17fd82b3dd6d3f22071dff

SHA1
17d54ee54b45ee6d01f788c9ddd14539daa17231

SHA256
02ab232257d51a1aaae98c051cdae17dca3354faaf5b1a1a2a4681ff34e0e5aa

SHA512
aab7baa2b9452733a77aec3a510d541d8f0ce12025270ff3ecb4fc6d70786addb35f2bb0451b2c89a4f79e37cc860d545a9486ff212eec9f5ca8370a03220cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_A7FD0358678DD9A60B088826E34291DA

Filesize
471B

MD5
24def796a46ab599bebc700e9d520767

SHA1
c7719c76228ee7fc2f60db317ba35983bc6a34e0

SHA256
b3d157c844b9d874300b8c31e2c7d7d5a5dcb5625e8cf90a8438cb0f2bb8c4f6

SHA512
c1a5301a83236c6f835517beecb0ebd495a269ece81466e94147d8d4992dee2b8ad15316bb474ccf4293d78e0cec3fd0729cee949502e517866fc60db6931781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
04c8d52812edefdc54a357fd247074d7

SHA1
e1f8dc80d01112419f94cd1565a564346f690080

SHA256
c07b5333f44df28eb71865287ad6bf4c2da7dc318db12c42c651053f101a82a0

SHA512
997cdbf3da84d6894ff8f52056cd64cdabe01a1a4a701736799f88b97ee9c9750d632ff97664047fbcc7499afe5baffd0d163de5f218eb7f51b91cf9a9413c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_A7FD0358678DD9A60B088826E34291DA

Filesize
400B

MD5
fc154d28f6fab51afd964f4b9e5be85a

SHA1
b0efc978005c2a2c893e2147b0a088412dc481c1

SHA256
b83030b648a146165a9ecdf1e3de572d5147eb46d57e99f825adb37e92f2383b

SHA512
641e02e1adbb70322c95292469eb94cede1f0b3efcdc30cb3e93665974d3766819ef6c818fdb51444c3ba815b4a707fc8b2d1b8b2bd1d1114afbf80bb54291b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2024-02-12_201248806.json.gz

Filesize
4KB

MD5
8098fc172ef41eec069064d97f9665c0

SHA1
209714a0a2f1f64b89a27f7bb9be015467e17600

SHA256
9fa62f93cc5e9cd8f12759cefeb0c297b54d066509424bfea1be3f3a82d87f2a

SHA512
179b959bfeaea099a3a88d3038ef62b3ca9b03eb60a5caea41db6abae82d55bf50244a020b494e03ff41ddb7aaeebca1e2e469bfa5978f94db608e8feba9e0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2024-02-12_201248806.json.meta

Filesize
65B

MD5
c2d72260b08546def2be671368e35eb2

SHA1
dbe10e6c053f1287162b48abba42f5547f3581f2

SHA256
7220c6e92b06c18824afe9b75d942a9cccfe72fe25dd5dc903ff4bdecc15b6a2

SHA512
d9a448c40a9ef5b70892f5b677db291a4f7c1010a579085ca6d2e64ba427d302027950c2530c9a3d60473b70fe0f13c35ed0a4044f3c072c531a7bd578c61c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2024-02-12_201311150.json.gz

Filesize
5KB

MD5
ecfbf1b81aa38b884a6c89d4101145f7

SHA1
6ebb0d514dbd29742281808cd3808c1fafe7e426

SHA256
5f2bf2e911f99ba489031658f60eab9462d0952114904037fbc8f1bbf33044c9

SHA512
8de6ff6408a7dad7435d88c4924f9e65acb39c89a98f7e33ab1d616c38f9fb85718293ed6316dbd319a692ae288b0b1948fc2b048c5b02d8395690de9d009612

Download Submit
C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2024-02-12_201311150.json.meta

Filesize
65B

MD5
4ed992289f9f24723a7f826f62f2e7ca

SHA1
bb278854891963c61472e214b140faa41cc9ad52

SHA256
4bcbbd435dff55f89e7f2d4d59dd36587a72183a74f755e6adf378abdd7526a3

SHA512
f924acb345f0fb94b75abbd0ead5e65c3409231af18478735bae7b6f04b7730015e9ebee6c703f6536d59f1f02eae9d98051c55f1e56e7996f4012a145abe0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Player.log

Filesize
16KB

MD5
a831b2eb994d977e9473aad976441a6e

SHA1
b5a897616a37a3e3c20bf24401af1876764a0495

SHA256
f5215e3f1cce87fe2c30946c91c9461e432b4fbdee3977254992ccdf118878ac

SHA512
d1062b15d3b4c2afaa876ad6430145e36e15d54619feaf05c1619d749895d8d554c01b5a05dba9edd9ca7b9743b73831c258cbec92dd70b5091a226f7814a8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Player.log

Filesize
15KB

MD5
cab16cb5dd16aa827568f9bed6293fb7

SHA1
c41eb38004b866cc9bc90fa0fd5d8ef7e2741a81

SHA256
2b5c449bd894ae08d20d2a894ac17648a7da327de3546ea038564bcaa7f9bedb

SHA512
99f02511b64d8380fffd71fb972086965c6ffc78d56e5ec87c22576a19477894961746b6deb7174f5917b6e9d86d4f6a46242fe452d66b7e8cb7a159711bfd46

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Unity\1fee820e-0c37-402a-927d-d35def5ef484\Analytics\ArchivedEvents\170776876000001.3f7b9449\s

Filesize
440B

MD5
62a7c58ab7b0cf6d573888f349f6117d

SHA1
875cda41d8f5b4eafebcc0c5f21e48e7aaf6f9de

SHA256
fcc0a311067e035ae7fa7b9dbc6095b2d466e868b180811943c3bdcb4a4329cf

SHA512
381bf31c31ace66ad6d7e65ae6388739adc9c662e03d79496709e48983666f3b33b200c64a27e17cf6559853adf2ecf7ec824cfdb54cd8a6bb2f2ec4044d59fe

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Unity\1fee820e-0c37-402a-927d-d35def5ef484\Analytics\ArchivedEvents\170776876000002.3f7b9449\c

Filesize
1B

MD5
c81e728d9d4c2f636f067f89cc14862c

SHA1
da4b9237bacccdf19c0760cab7aec4a8359010b0

SHA256
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

SHA512
40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Unity\1fee820e-0c37-402a-927d-d35def5ef484\Analytics\config

Filesize
293B

MD5
8673a8ac0b06a9d056d08d62f857ba4b

SHA1
a351bea1932270bafbe468584058fef20dcfc31e

SHA256
83b3f90c4edf1f122c8faf9784ca0aee4dd017c65493ac181c1814211703db96

SHA512
edf28eb7fcef654f139285d308f817ee230d6f064a4c865109d6dfe6f73c11f8f35737c8159c8a302118237ab980899ba5773f547cc9da4028643a53b08e324f

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Unity\1fee820e-0c37-402a-927d-d35def5ef484\Analytics\values

Filesize
135B

MD5
8898ee35e4e0b1628839d39038384097

SHA1
e47c3aa37af4fac2ab51f5112391103410a87645

SHA256
67e3a18a1c68cc5d47e52be039156b31ec987a3aa721c408efa2607a175ab819

SHA512
a3e129b4d1ea47f165b2b049dcf3093173b683157295e7d89c9b110f9bad3fc88fa5d8be412e02fe6b6a31e641b185f6ea0d9938d4d7655b5c35aeaf52323e46

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\worldboxData

Filesize
2KB

MD5
5392d9ea1dd18a7d980811d02bb68cb7

SHA1
c0781cdd4146d72cf4526475ee23c00e7805a2ce

SHA256
68e09b1af8ae5727374dc9bdd2226f549e5ee9cb148b4b60db6404c89e993cd0

SHA512
2d200ad345dc19c1d46570b87f7becbb018b31022efe9ac1bd0ecb1d233129724ac34ea04195716b3a6bf8872f17d4adf4eabf728073d1df511335725417c6d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8774a392-b0ef-4331-8356-08106049e116.tmp

Filesize
824B

MD5
d7dc579a95ce94a759e3da60f45d6c47

SHA1
ecc9592732539024912c3c396b06998c45cdac9f

SHA256
9d3804a405b82eeb25b3b16f4d69e970e9f79e56c330ff238be4b97ebd9e202f

SHA512
03505199270db5ee13aceb896250e51ea58e1aea1892ffe4216fb8465f833e6c764c023ff577b80d2ad9b47cda27d9541890b49b0b68dd143aa07811fcfc4d9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3b656cf92c122486517321c52196f4eb

SHA1
b2b3efdfbee35b4410846f087ea838d5bbaac0bf

SHA256
223ac31f476c2603b115edc881e81b0a1755a48709f41f3a3a62e4a939d25117

SHA512
af0bb76434a2bef6b304ad6a3633ad9e5db6daa9489ac7121b4870aa328f7222a2edc85a4f5aaac27fda8f9050d06f53aa92e3bac01e548aeb8ea6df7aa0629f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8c71b67f822268b129df5f2eb4253852

SHA1
7919b111b307d8f17182d5351441a967304d4d4e

SHA256
b79b330a21dbfc96e9759c1fb00a57bbc2f23f4ea080fb4ee45c0e92775dc1a9

SHA512
48ca24207c450156606889a208e4032b5af292e6a3ea7acb02df8a1099649d2b4fd7730e7cc301c2b72caa3debed3ee49a58ea82e590d9f2e6dd10ab807f1fa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
273525bb53d4d170db5ade65b3cb5221

SHA1
53cb43959d9d3f2231c7a0d313586c1088f3ea63

SHA256
c38aebaf3e6715143da46ecc5dae9f5d1ad2dd9671c5d86f696b5c538526ce9a

SHA512
e12c18927353e5d50e791f5d7a1486b22481c77b4cb91cbeff9b7d9cb2a77e0c9ce4833cb45c98c93f9c020c510cbcce789b590223e614ff9e9a966afb2cb368

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
b1f7f5ba5df27a58bbe46f042f6214cc

SHA1
5a119b8a7a9e5b0ebb74643d1fcdcc8174e8ea3f

SHA256
be4ab65583987ffea23f013316307639dc191680a6be0bad0ff6bd17dbd8fe87

SHA512
42ab1ff2579eb06a0865fb80f88064cc7401ce93570c04a58d8e837ca29e9d2e42d689fe489f67a3c4c1e0c16fe05fdbb7edff8d9aa188e79d3ac4f00aa16500

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
5ea877c669122a0d681b38ee8078381e

SHA1
9c23986ff1e61719e7f091337e1136ea8dba4c12

SHA256
a8a1724daee40e816b8a5eebe8754ec9611a81734779dde2c14ef20c16f9e3dd

SHA512
585da163fcc91d0260e8e1a284d576ee0cdd5f81c179d9fb16e56b79c027571c752d101f13bae43d8f5f5d5d695cf21e92e6d003d69f8b7b6458b2280a9bc46f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5aee0b.TMP

Filesize
107KB

MD5
8e22b987a0f095cf0c821dec16af026f

SHA1
e42aace9a69cea07866df3aeb9d8d67be500a68d

SHA256
1a18add1fa40a26be57ac36d315da0e7934c676ab10d7434121e589b15b633b0

SHA512
632c942342cd2eb9a93f51ed4a908911b1e3821fe3a431b20651cd1699fd03b51c010d8c36642f2a7af2ac0256ee23119e70fc6b10b79f47884a3b1bb9e4aa93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\account_name.txt

Filesize
4B

MD5
654e1c2ac6312d8c6441282f155c8ce9

SHA1
b601eaa0f87fe94355f635b77a7608b971ea8825

SHA256
bc3a7860cd4f58f3e1e66a20e3cb2930477121c46b9e030636bc6c5cfd050071

SHA512
a3adcc6bef462dcea21dd995bec6b4466c68ee85c8059c27fba7bb33ec57ec00c6bed9528be92d1044100b749a68ee439f84c9b8a37d1dd13d7fccbe231ed31a

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\language.txt

Filesize
7B

MD5
ba0a6ddd94c73698a3658f92ac222f8a

SHA1
1b669334dae8ebafa433f0175b5fd418a7bc0975

SHA256
b6234d2ea0d6022be63db80d7b80e221097fe4a469dc44febcd2a9241effdeba

SHA512
0882b702e0f4c1db1701789796ab1d12d72627811b67299bf36b9b25c29465cc24e72483d171c435368dc9f777837d2bd45ccff293de2207d32ba58a6ac01023

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\listen_port.txt

Filesize
5B

MD5
76bf79e9a0a4c128d97dbd6900773f4b

SHA1
8abb38a924d5bf8a1ee12fe96aa2d2be942704d6

SHA256
45095e3e3f29ea73ffab2e23158b7cd2afa6532004b5a9b6f06d4e5e068a89aa

SHA512
8cd54c07d87c41103d963eb7dfd2642b07bb67ceb731b477fc9cd9b736ab03833dc2e2d0b2eb399002d76d405a20d5816d19d77ef760d7dac0c1a67d80662535

Download Submit
C:\Users\Admin\AppData\Roaming\Goldberg SteamEmu Saves\settings\user_steam_id.txt

Filesize
17B

MD5
169d31d6f5b098926d7f762b0b1ef884

SHA1
319a611a04b93a62bfa85e9f9eea8effe7cca2b8

SHA256
fb6e28392fc68bad16fac3f4682a99acdf89b7a433e200e4dab7c7b84611fa54

SHA512
178f0af0a5cce6ad8c0ca8428c94f8e3f4e6b1c22fe5a92c6d36ee8c7e46ca285a1a84d9c6b55a1e5eeefd36d33c65816e8b4c710fcf28ef2ef45c770cba3dc2

Download Submit
memory/2236-174-0x0000023A631F0000-0x0000023A63200000-memory.dmp

Filesize
64KB

Download
memory/2236-186-0x0000023A3F370000-0x0000023A3F380000-memory.dmp

Filesize
64KB

Download
memory/2236-122-0x0000023A1DD30000-0x0000023A1DD40000-memory.dmp

Filesize
64KB

Download
memory/2236-123-0x0000023A3F590000-0x0000023A3F5A0000-memory.dmp

Filesize
64KB

Download
memory/2236-124-0x0000023A1DD40000-0x0000023A1DD50000-memory.dmp

Filesize
64KB

Download
memory/2236-125-0x0000023A3F6B0000-0x0000023A3F6C0000-memory.dmp

Filesize
64KB

Download
memory/2236-126-0x0000023A3F6D0000-0x0000023A3F6E0000-memory.dmp

Filesize
64KB

Download
memory/2236-127-0x0000023A3F6C0000-0x0000023A3F6D0000-memory.dmp

Filesize
64KB

Download
memory/2236-119-0x0000023A1D0C0000-0x0000023A1D0D0000-memory.dmp

Filesize
64KB

Download
memory/2236-130-0x0000023A3DDB0000-0x0000023A3DDC0000-memory.dmp

Filesize
64KB

Download
memory/2236-166-0x0000023A3DDC0000-0x0000023A3DDD0000-memory.dmp

Filesize
64KB

Download
memory/2236-168-0x0000023A5F730000-0x0000023A5F740000-memory.dmp

Filesize
64KB

Download
memory/2236-167-0x0000023A3F720000-0x0000023A3F730000-memory.dmp

Filesize
64KB

Download
memory/2236-169-0x0000023A63030000-0x0000023A63040000-memory.dmp

Filesize
64KB

Download
memory/2236-170-0x0000023A3DEC0000-0x0000023A3DED0000-memory.dmp

Filesize
64KB

Download
memory/2236-171-0x0000023A3DED0000-0x0000023A3DEE0000-memory.dmp

Filesize
64KB

Download
memory/2236-172-0x0000023A63040000-0x0000023A63050000-memory.dmp

Filesize
64KB

Download
memory/2236-173-0x0000023A631D0000-0x0000023A631E0000-memory.dmp

Filesize
64KB

Download
memory/2236-120-0x0000023A3F570000-0x0000023A3F590000-memory.dmp

Filesize
128KB

Download
memory/2236-175-0x0000023A631E0000-0x0000023A631F0000-memory.dmp

Filesize
64KB

Download
memory/2236-176-0x0000023A3DEE0000-0x0000023A3DEF0000-memory.dmp

Filesize
64KB

Download
memory/2236-177-0x0000023A3E320000-0x0000023A3E330000-memory.dmp

Filesize
64KB

Download
memory/2236-178-0x0000023A63200000-0x0000023A63210000-memory.dmp

Filesize
64KB

Download
memory/2236-179-0x0000023A63220000-0x0000023A63230000-memory.dmp

Filesize
64KB

Download
memory/2236-180-0x0000023A64200000-0x0000023A64220000-memory.dmp

Filesize
128KB

Download
memory/2236-181-0x0000023A643E0000-0x0000023A643F0000-memory.dmp

Filesize
64KB

Download
memory/2236-182-0x0000023A63210000-0x0000023A63220000-memory.dmp

Filesize
64KB

Download
memory/2236-183-0x0000023A3E380000-0x0000023A3E390000-memory.dmp

Filesize
64KB

Download
memory/2236-184-0x0000023A643D0000-0x0000023A643E0000-memory.dmp

Filesize
64KB

Download
memory/2236-185-0x0000023A643F0000-0x0000023A64420000-memory.dmp

Filesize
192KB

Download
memory/2236-187-0x0000023A3F570000-0x0000023A3F590000-memory.dmp

Filesize
128KB

Download
memory/2236-121-0x0000023A3F560000-0x0000023A3F570000-memory.dmp

Filesize
64KB

Download
memory/2236-189-0x0000023A64670000-0x0000023A64680000-memory.dmp

Filesize
64KB

Download
memory/2236-188-0x0000023A64660000-0x0000023A64670000-memory.dmp

Filesize
64KB

Download
memory/2236-190-0x0000023A646B0000-0x0000023A646C0000-memory.dmp

Filesize
64KB

Download
memory/2236-191-0x0000023A64710000-0x0000023A64720000-memory.dmp

Filesize
64KB

Download
memory/2236-192-0x0000023A64720000-0x0000023A64730000-memory.dmp

Filesize
64KB

Download
memory/2236-193-0x0000023A64680000-0x0000023A646B0000-memory.dmp

Filesize
192KB

Download
memory/2236-194-0x0000023A64700000-0x0000023A64710000-memory.dmp

Filesize
64KB

Download
memory/2236-195-0x0000023A64A30000-0x0000023A64A40000-memory.dmp

Filesize
64KB

Download
memory/2236-196-0x0000023A3F560000-0x0000023A3F570000-memory.dmp

Filesize
64KB

Download
memory/2236-197-0x0000023A3F590000-0x0000023A3F5A0000-memory.dmp

Filesize
64KB

Download
memory/2236-198-0x0000023A64A50000-0x0000023A64A60000-memory.dmp

Filesize
64KB

Download
memory/2236-199-0x0000023A3F6B0000-0x0000023A3F6C0000-memory.dmp

Filesize
64KB

Download
memory/2236-201-0x0000023A65A80000-0x0000023A65A90000-memory.dmp

Filesize
64KB

Download
memory/2236-200-0x0000023A3F6D0000-0x0000023A3F6E0000-memory.dmp

Filesize
64KB

Download
memory/2236-117-0x0000023A3F360000-0x0000023A3F370000-memory.dmp

Filesize
64KB

Download
memory/2236-118-0x0000023A3F370000-0x0000023A3F380000-memory.dmp

Filesize
64KB

Download
memory/2236-114-0x00000239DBC20000-0x00000239DBC40000-memory.dmp

Filesize
128KB

Download
memory/2236-113-0x0000023A3E380000-0x0000023A3E390000-memory.dmp

Filesize
64KB

Download
memory/2236-112-0x0000023A3E320000-0x0000023A3E330000-memory.dmp

Filesize
64KB

Download
memory/2236-111-0x0000023857F10000-0x0000023857F20000-memory.dmp

Filesize
64KB

Download
memory/2236-110-0x0000023858020000-0x0000023858030000-memory.dmp

Filesize
64KB

Download
memory/2236-109-0x0000023A3DEE0000-0x0000023A3DEF0000-memory.dmp

Filesize
64KB

Download
memory/2236-108-0x0000023A3DED0000-0x0000023A3DEE0000-memory.dmp

Filesize
64KB

Download
memory/2236-107-0x0000023A3DEC0000-0x0000023A3DED0000-memory.dmp

Filesize
64KB

Download
memory/2236-106-0x0000023A3DDC0000-0x0000023A3DDD0000-memory.dmp

Filesize
64KB

Download
memory/2236-105-0x0000023A3DDB0000-0x0000023A3DDC0000-memory.dmp

Filesize
64KB

Download
memory/2236-104-0x0000023A1DD40000-0x0000023A1DD50000-memory.dmp

Filesize
64KB

Download
memory/2236-103-0x0000023A1DD30000-0x0000023A1DD40000-memory.dmp

Filesize
64KB

Download
memory/2236-102-0x0000023A1D0C0000-0x0000023A1D0D0000-memory.dmp

Filesize
64KB

Download
memory/2236-101-0x00000239DBC20000-0x00000239DBC40000-memory.dmp

Filesize
128KB

Download
memory/2236-100-0x0000023857F10000-0x0000023857F20000-memory.dmp

Filesize
64KB

Download
memory/2236-99-0x0000023858020000-0x0000023858030000-memory.dmp

Filesize
64KB

Download