f11bec29bd627dfae257e9930986222e21aac26f310307c5d4397b9c4baa738a

Analysis

max time kernel
1313s
max time network
1397s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-11-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WorldBox.God.Simulator.v0.22.9.558/Game/worldbox.exe
Size

638KB
MD5

3c4f1e12277c21f2c58ff0499bb0334b
SHA1

3ccbc8febb2c32e2c50f40632f0bc4c752b331f9
SHA256

c662058aaa67a28679305ec1419a7f1c341cf5741e94255891f12d86e782e30f
SHA512

9e203586c645aac195bc789c018c921f94f9be187bd96c4bba9109dd56222739800e341d84c2b7ade0123a846fcf1b5010e30703fdb86d273af153a96ab0dc38
SSDEEP

3072:HgXpJozm2lkCspYDbMwqrWunCrKQJgHm3RV6ESwMvGj5a5vSHE:epC62lkCTIWunOKQ4m3RV6NwcGASHE

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\d3d11.pdb	UnityCrashHandler64.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\exe\WindowsPlayer_Master_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\d3d10warp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	worldbox.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	worldbox.exe
File opened for modification	C:\Windows\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\fmodstudio.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	worldbox.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	worldbox.exe
File opened for modification	C:\Windows\symbols\dll\UnityPlayer_Win64_mono_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\mswsock.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\fmodstudio.pdb	UnityCrashHandler64.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	worldbox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	worldbox.exe
Key opened	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	worldbox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	worldbox.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	worldbox.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	worldbox.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	worldbox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3632	worldbox.exe
3632	worldbox.exe
1076	UnityCrashHandler64.exe
1076	UnityCrashHandler64.exe
1076	UnityCrashHandler64.exe
1076	UnityCrashHandler64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4612	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3632	worldbox.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1076	3632	worldbox.exe	85
PID 3632 wrote to memory of 1076	3632	worldbox.exe	85
PID 1076 wrote to memory of 2504	1076	UnityCrashHandler64.exe	91
PID 1076 wrote to memory of 2504	1076	UnityCrashHandler64.exe	91

C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\worldbox.exe
"C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\worldbox.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\UnityCrashHandler64.exe" --attach 3632 2095694417920
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\UnityCrashHandler64.exe
    "C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\UnityCrashHandler64.exe" "3632" "2095694417920"
    3⤵
    PID:2504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2024-11-21_153940934.json.gz

Filesize
5KB

MD5
ae36ee2775bc098af8fa7ea21b853045

SHA1
aac1058751dc324a32c4efaef06bb5d695749361

SHA256
168a96566c61cef11b04652bca6af23806fcef77373edcd4468177bbb75462c1

SHA512
0214942cf292351c9d6f0845ee84b30b126d8b722b817f852fdc786e2568b5c96e9cf696d8f1b49c7b52a3828e31798a326b7135e0d244e0b3d55578277168ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2024-11-21_153940934.json.meta

Filesize
65B

MD5
388fa3e1a722070c3fba4f8ba8bf4d02

SHA1
307812c85a9a47844752bd1d13709d4d8cc7c864

SHA256
8eaaadd1c9818f56e18182ccc069eeaf8cbbf25c2dc3dd1888ef303bedb17fa4

SHA512
c794837eb0dc83abe25aceb344b79e46ce3e33b66659379c50c74a41f78ffcdc4cd52d37df82beca679ab62e20b620c980afbd8e4a50a037b2e9826ef0ae7578

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Player.log

Filesize
16KB

MD5
e94dc06bbaadd3cf71c1761d9e9484e4

SHA1
65b6487b8ae80c5433109e6437e121970df7d767

SHA256
af3bbb5b94057d9d7de44d70534a4ed7346af1af51aa80db67c14ae147ddfb4e

SHA512
1a07063a737ef2cc2f9d57ee7cabe74ad7714f99f895dca3c14584559ec2bd72d2ed90d8575c345b71b0e636b2039a9c99aa13ca1407d340730eb18efa75fe55

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Unity\1fee820e-0c37-402a-927d-d35def5ef484\Analytics\ArchivedEvents\173220357400002.15c992cc\c

Filesize
1B

MD5
c81e728d9d4c2f636f067f89cc14862c

SHA1
da4b9237bacccdf19c0760cab7aec4a8359010b0

SHA256
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

SHA512
40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

Download Submit
C:\Users\Admin\AppData\LocalLow\mkarpenko\WorldBox\Unity\1fee820e-0c37-402a-927d-d35def5ef484\Analytics\ArchivedEvents\173220357400002.15c992cc\s

Filesize
440B

MD5
d372c2ac678d9947219809366e017849

SHA1
449659ac564590775fe0c60e8d00432dfcaae0c2

SHA256
68806da6e833f5cb5139413c9e749186fc079694b82997c2f238f800b7d7170f

SHA512
20450df81c03804ac30eceb4a85154bb250a7298c5c8051c344e070e6404f0765b1a4f401c029730a6d05d725281cce136d1929effe0d38e84e8c265a0c68b82

Download Submit
memory/3632-88-0x000001E9DCE50000-0x000001E9DCE60000-memory.dmp

Filesize
64KB

Download
memory/3632-25-0x000001E9B90B0000-0x000001E9B90D0000-memory.dmp

Filesize
128KB

Download
memory/3632-7-0x000001E977970000-0x000001E977980000-memory.dmp

Filesize
64KB

Download
memory/3632-10-0x000001E977990000-0x000001E9779A0000-memory.dmp

Filesize
64KB

Download
memory/3632-9-0x000001E7F1220000-0x000001E7F1230000-memory.dmp

Filesize
64KB

Download
memory/3632-8-0x000001E7F1330000-0x000001E7F1340000-memory.dmp

Filesize
64KB

Download
memory/3632-11-0x000001E9B7AE0000-0x000001E9B7AF0000-memory.dmp

Filesize
64KB

Download
memory/3632-13-0x000001E9B7AF0000-0x000001E9B7B00000-memory.dmp

Filesize
64KB

Download
memory/3632-12-0x000001E955830000-0x000001E955850000-memory.dmp

Filesize
128KB

Download
memory/3632-15-0x000001E9B7F30000-0x000001E9B7F40000-memory.dmp

Filesize
64KB

Download
memory/3632-14-0x000001E976CD0000-0x000001E976CE0000-memory.dmp

Filesize
64KB

Download
memory/3632-16-0x000001E9B7F90000-0x000001E9B7FA0000-memory.dmp

Filesize
64KB

Download
memory/3632-17-0x000001E9B7FA0000-0x000001E9B7FB0000-memory.dmp

Filesize
64KB

Download
memory/3632-19-0x000001E9B8F80000-0x000001E9B8F90000-memory.dmp

Filesize
64KB

Download
memory/3632-18-0x000001E977910000-0x000001E977920000-memory.dmp

Filesize
64KB

Download
memory/3632-23-0x000001E9B90A0000-0x000001E9B90B0000-memory.dmp

Filesize
64KB

Download
memory/3632-22-0x000001E977940000-0x000001E977950000-memory.dmp

Filesize
64KB

Download
memory/3632-89-0x000001E9B9210000-0x000001E9B9220000-memory.dmp

Filesize
64KB

Download
memory/3632-24-0x000001E977960000-0x000001E977970000-memory.dmp

Filesize
64KB

Download
memory/3632-27-0x000001E9B90D0000-0x000001E9B90E0000-memory.dmp

Filesize
64KB

Download
memory/3632-26-0x000001E977970000-0x000001E977980000-memory.dmp

Filesize
64KB

Download
memory/3632-5-0x000001E977940000-0x000001E977950000-memory.dmp

Filesize
64KB

Download
memory/3632-48-0x000001E9B91F0000-0x000001E9B9200000-memory.dmp

Filesize
64KB

Download
memory/3632-47-0x000001E977990000-0x000001E9779A0000-memory.dmp

Filesize
64KB

Download
memory/3632-49-0x000001E9B7AE0000-0x000001E9B7AF0000-memory.dmp

Filesize
64KB

Download
memory/3632-50-0x000001E9B9200000-0x000001E9B9210000-memory.dmp

Filesize
64KB

Download
memory/3632-51-0x000001E9B7AF0000-0x000001E9B7B00000-memory.dmp

Filesize
64KB

Download
memory/3632-87-0x000001E9B9200000-0x000001E9B9210000-memory.dmp

Filesize
64KB

Download
memory/3632-54-0x000001E9B9320000-0x000001E9B9330000-memory.dmp

Filesize
64KB

Download
memory/3632-53-0x000001E9B7F30000-0x000001E9B7F40000-memory.dmp

Filesize
64KB

Download
memory/3632-4-0x000001E977910000-0x000001E977920000-memory.dmp

Filesize
64KB

Download
memory/3632-90-0x000001E9DCE60000-0x000001E9DCE70000-memory.dmp

Filesize
64KB

Download
memory/3632-73-0x000001E9B7F90000-0x000001E9B7FA0000-memory.dmp

Filesize
64KB

Download
memory/3632-76-0x000001E9DCC70000-0x000001E9DCC80000-memory.dmp

Filesize
64KB

Download
memory/3632-75-0x000001E9B7FA0000-0x000001E9B7FB0000-memory.dmp

Filesize
64KB

Download
memory/3632-78-0x000001E9DCDC0000-0x000001E9DCDD0000-memory.dmp

Filesize
64KB

Download
memory/3632-77-0x000001E9B8F80000-0x000001E9B8F90000-memory.dmp

Filesize
64KB

Download
memory/3632-80-0x000001E9DCDD0000-0x000001E9DCDE0000-memory.dmp

Filesize
64KB

Download
memory/3632-79-0x000001E9B90A0000-0x000001E9B90B0000-memory.dmp

Filesize
64KB

Download
memory/3632-82-0x000001E9DCDE0000-0x000001E9DCDF0000-memory.dmp

Filesize
64KB

Download
memory/3632-81-0x000001E9B90B0000-0x000001E9B90D0000-memory.dmp

Filesize
128KB

Download
memory/3632-84-0x000001E9DCE30000-0x000001E9DCE40000-memory.dmp

Filesize
64KB

Download
memory/3632-83-0x000001E9B90D0000-0x000001E9B90E0000-memory.dmp

Filesize
64KB

Download
memory/3632-86-0x000001E9DCE40000-0x000001E9DCE50000-memory.dmp

Filesize
64KB

Download
memory/3632-85-0x000001E9B91F0000-0x000001E9B9200000-memory.dmp

Filesize
64KB

Download
memory/3632-0-0x000001E7F1330000-0x000001E7F1340000-memory.dmp

Filesize
64KB

Download
memory/3632-52-0x000001E9B9210000-0x000001E9B9220000-memory.dmp

Filesize
64KB

Download
memory/3632-6-0x000001E977960000-0x000001E977970000-memory.dmp

Filesize
64KB

Download
memory/3632-74-0x000001E9D9330000-0x000001E9D9340000-memory.dmp

Filesize
64KB

Download
memory/3632-92-0x000001E9DDE40000-0x000001E9DDE60000-memory.dmp

Filesize
128KB

Download
memory/3632-91-0x000001E9B9320000-0x000001E9B9330000-memory.dmp

Filesize
64KB

Download
memory/3632-94-0x000001E9DE020000-0x000001E9DE030000-memory.dmp

Filesize
64KB

Download
memory/3632-93-0x000001E9D9330000-0x000001E9D9340000-memory.dmp

Filesize
64KB

Download
memory/3632-96-0x000001E9DE030000-0x000001E9DE040000-memory.dmp

Filesize
64KB

Download
memory/3632-95-0x000001E9DCC70000-0x000001E9DCC80000-memory.dmp

Filesize
64KB

Download
memory/3632-98-0x000001E9DE040000-0x000001E9DE070000-memory.dmp

Filesize
192KB

Download
memory/3632-97-0x000001E9DCDC0000-0x000001E9DCDD0000-memory.dmp

Filesize
64KB

Download
memory/3632-100-0x000001E9DE2C0000-0x000001E9DE2D0000-memory.dmp

Filesize
64KB

Download
memory/3632-99-0x000001E9DCDD0000-0x000001E9DCDE0000-memory.dmp

Filesize
64KB

Download
memory/3632-102-0x000001E9DE310000-0x000001E9DE320000-memory.dmp

Filesize
64KB

Download
memory/3632-101-0x000001E9DCDE0000-0x000001E9DCDF0000-memory.dmp

Filesize
64KB

Download
memory/3632-103-0x000001E9DCE30000-0x000001E9DCE40000-memory.dmp

Filesize
64KB

Download
memory/3632-104-0x000001E9DE320000-0x000001E9DE350000-memory.dmp

Filesize
192KB

Download
memory/3632-106-0x000001E9DE350000-0x000001E9DE360000-memory.dmp

Filesize
64KB

Download
memory/3632-105-0x000001E9DCE40000-0x000001E9DCE50000-memory.dmp

Filesize
64KB

Download
memory/3632-108-0x000001E9DE360000-0x000001E9DE370000-memory.dmp

Filesize
64KB

Download
memory/3632-107-0x000001E9DCE50000-0x000001E9DCE60000-memory.dmp

Filesize
64KB

Download
memory/3632-110-0x000001E9DE370000-0x000001E9DE380000-memory.dmp

Filesize
64KB

Download
memory/3632-109-0x000001E9DCE60000-0x000001E9DCE70000-memory.dmp

Filesize
64KB

Download
memory/3632-112-0x000001E9DE380000-0x000001E9DE390000-memory.dmp

Filesize
64KB

Download
memory/3632-111-0x000001E9DDE40000-0x000001E9DDE60000-memory.dmp

Filesize
128KB

Download
memory/3632-114-0x000001E9DE390000-0x000001E9DE3A0000-memory.dmp

Filesize
64KB

Download
memory/3632-113-0x000001E9DE020000-0x000001E9DE030000-memory.dmp

Filesize
64KB

Download
memory/3632-116-0x000001E9DE3B0000-0x000001E9DE3C0000-memory.dmp

Filesize
64KB

Download
memory/3632-115-0x000001E9DE030000-0x000001E9DE040000-memory.dmp

Filesize
64KB

Download
memory/3632-123-0x000001E9DE040000-0x000001E9DE070000-memory.dmp

Filesize
192KB

Download
memory/3632-131-0x000001E9DE2C0000-0x000001E9DE2D0000-memory.dmp

Filesize
64KB

Download
memory/3632-132-0x000001E9DE310000-0x000001E9DE320000-memory.dmp

Filesize
64KB

Download
memory/3632-133-0x000001E9DE320000-0x000001E9DE350000-memory.dmp

Filesize
192KB

Download
memory/3632-3-0x000001E976CD0000-0x000001E976CE0000-memory.dmp

Filesize
64KB

Download
memory/3632-2-0x000001E955830000-0x000001E955850000-memory.dmp

Filesize
128KB

Download
memory/3632-1-0x000001E7F1220000-0x000001E7F1230000-memory.dmp

Filesize
64KB

Download
memory/3632-141-0x000001E9DE350000-0x000001E9DE360000-memory.dmp

Filesize
64KB

Download
memory/3632-148-0x000001E7F1330000-0x000001E7F1340000-memory.dmp

Filesize
64KB

Download
memory/3632-149-0x000001E7F1220000-0x000001E7F1230000-memory.dmp

Filesize
64KB

Download
memory/3632-152-0x000001E977910000-0x000001E977920000-memory.dmp

Filesize
64KB

Download
memory/3632-160-0x000001E9B7F90000-0x000001E9B7FA0000-memory.dmp

Filesize
64KB

Download
memory/3632-159-0x000001E9B7F30000-0x000001E9B7F40000-memory.dmp

Filesize
64KB

Download
memory/3632-158-0x000001E9B7AF0000-0x000001E9B7B00000-memory.dmp

Filesize
64KB

Download
memory/3632-157-0x000001E9B7AE0000-0x000001E9B7AF0000-memory.dmp

Filesize
64KB

Download
memory/3632-156-0x000001E977990000-0x000001E9779A0000-memory.dmp

Filesize
64KB

Download
memory/3632-155-0x000001E977970000-0x000001E977980000-memory.dmp

Filesize
64KB

Download
memory/3632-154-0x000001E977960000-0x000001E977970000-memory.dmp

Filesize
64KB

Download
memory/3632-153-0x000001E977940000-0x000001E977950000-memory.dmp

Filesize
64KB

Download
memory/3632-151-0x000001E976CD0000-0x000001E976CE0000-memory.dmp

Filesize
64KB

Download
memory/3632-150-0x000001E955830000-0x000001E955850000-memory.dmp

Filesize
128KB

Download