hxxps://krafter[.]itch[.]io/quicksand

Resubmissions

04/11/2026, 19:50

261104-ykbsvsft4q7

04/11/2026, 19:31

261104-x8n8eszt6k7

Analysis

user interaction
yes
max time kernel
179s
max time network
181s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://krafter.itch.io/quicksand
Sample261104-ykbsvsft4q

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5440	quicksand.exe

Loads dropped DLL 2 IoCs

pid	Process
5440	quicksand.exe
5440	quicksand.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	quicksand.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	quicksand.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3336	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	quicksand.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	quicksand.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	quicksand.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	quicksand.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "130"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{B2AE766E-B0C0-40ED-B331-DBBD4687676A}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{08A244EB-9A4C-4F50-B4F7-5D44879AA133}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Quicksand.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5440	quicksand.exe
5440	quicksand.exe
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4340	7zFM.exe
5440	quicksand.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4340	7zFM.exe
Token: 35	4340	7zFM.exe
Token: SeSecurityPrivilege	4340	7zFM.exe
Token: 33	5672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5672	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
4340	7zFM.exe
4340	7zFM.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
5440	quicksand.exe
5184	LogonUI.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 848	3904	msedge.exe	80
PID 3904 wrote to memory of 4088	3904	msedge.exe	81
PID 3904 wrote to memory of 3336	3904	msedge.exe	82
PID 3904 wrote to memory of 4088	3904	msedge.exe	81
PID 3904 wrote to memory of 4088	3904	msedge.exe	81
PID 3904 wrote to memory of 4804	3904	msedge.exe	83
PID 3904 wrote to memory of 4804	3904	msedge.exe	83
PID 3904 wrote to memory of 1392	3904	msedge.exe	85
PID 3904 wrote to memory of 1392	3904	msedge.exe	85
PID 3904 wrote to memory of 5016	3904	msedge.exe	86
PID 3904 wrote to memory of 1392	3904	msedge.exe	85
PID 3904 wrote to memory of 5016	3904	msedge.exe	86
PID 3904 wrote to memory of 5016	3904	msedge.exe	86
PID 3904 wrote to memory of 892	3904	msedge.exe	87
PID 3904 wrote to memory of 440	3904	msedge.exe	88
PID 3904 wrote to memory of 892	3904	msedge.exe	87
PID 3904 wrote to memory of 892	3904	msedge.exe	87
PID 3904 wrote to memory of 440	3904	msedge.exe	88
PID 3904 wrote to memory of 440	3904	msedge.exe	88
PID 3904 wrote to memory of 852	3904	msedge.exe	89
PID 3904 wrote to memory of 852	3904	msedge.exe	89
PID 3904 wrote to memory of 852	3904	msedge.exe	89
PID 3904 wrote to memory of 3988	3904	msedge.exe	90
PID 3904 wrote to memory of 3988	3904	msedge.exe	90
PID 3904 wrote to memory of 3988	3904	msedge.exe	90
PID 3904 wrote to memory of 3184	3904	msedge.exe	93
PID 3904 wrote to memory of 4460	3904	msedge.exe	94
PID 3904 wrote to memory of 3184	3904	msedge.exe	93
PID 3904 wrote to memory of 4460	3904	msedge.exe	94
PID 3904 wrote to memory of 5088	3904	msedge.exe	96
PID 3904 wrote to memory of 392	3904	msedge.exe	97
PID 392 wrote to memory of 4352	392	msedge.exe	98
PID 3904 wrote to memory of 4896	3904	msedge.exe	99
PID 3904 wrote to memory of 4896	3904	msedge.exe	99
PID 3904 wrote to memory of 4896	3904	msedge.exe	99
PID 3904 wrote to memory of 1936	3904	msedge.exe	100
PID 3904 wrote to memory of 1936	3904	msedge.exe	100
PID 3904 wrote to memory of 892	3904	msedge.exe	101
PID 3904 wrote to memory of 892	3904	msedge.exe	101
PID 3904 wrote to memory of 892	3904	msedge.exe	101
PID 3904 wrote to memory of 580	3904	msedge.exe	102
PID 3904 wrote to memory of 3772	3904	msedge.exe	104
PID 3904 wrote to memory of 3772	3904	msedge.exe	104
PID 3904 wrote to memory of 3772	3904	msedge.exe	104
PID 3904 wrote to memory of 568	3904	msedge.exe	105
PID 3904 wrote to memory of 568	3904	msedge.exe	105
PID 3904 wrote to memory of 568	3904	msedge.exe	105
PID 3904 wrote to memory of 228	3904	msedge.exe	108
PID 3904 wrote to memory of 2856	3904	msedge.exe	109
PID 3904 wrote to memory of 2828	3904	msedge.exe	110
PID 3904 wrote to memory of 3040	3904	msedge.exe	114
PID 3904 wrote to memory of 3040	3904	msedge.exe	114
PID 3904 wrote to memory of 6124	3904	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://krafter.itch.io/quicksand
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7fff5c1dc188,0x7fff5c1dc194,0x7fff5c1dc1a0
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,2572399267650283563,5209042895910765280,262144 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10346136293785450434,2521617807849443235,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,2595470058715548497,7883652830481084094,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,4100001443810306837,17677974385270690880,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8866900554335816464,7034417274831364139,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,18104655616556358349,8330109972768921125,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10971386137478430965,17704321393495228263,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4304,i,3940918613028501572,8163963606566426441,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,14258272332085610531,13370722584268770451,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:9
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,891352212539537584,1270239196732610764,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,17910808744790695812,16237467187860507830,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,15479162856255703346,1705301087506510290,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,15479162856255703346,1705301087506510290,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11493925101020205957,1216500654710160303,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6780,i,11792930244967430360,17720285919103495205,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,380786425731154903,1761825742127529592,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4732,i,12769780144225061933,13678558457812134261,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,674602144960009079,10448959707305999941,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  - NTFS ADS
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6592,i,11662269744246777895,530386965595554911,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6804,i,1103337410502162556,17315683615671377021,2097152 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,18011682881857868963,8378933074857361659,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,14145510750098034864,11221552950293722385,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,15374230947944208602,10458384872884510740,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,13560349681098431033,17163325511049801112,524288 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6520,i,2340084233054114799,16249303351289644452,262144 --field-trial-handle=2132,i,4588076548342085208,4418383007613228306,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:424

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4340

C:\Users\Admin\Downloads\Quicksand\quicksand.exe
"C:\Users\Admin\Downloads\Quicksand\quicksand.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5672

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a33055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\LocalLow\DefaultCompany\Quicksand\Unity\local.45a35f49bc7756c4c8bf8c8ac6d868fb\Analytics\ArchivedEvents\179382193100001.dee975c3\g
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\DefaultCompany\Quicksand\Unity\local.45a35f49bc7756c4c8bf8c8ac6d868fb\Analytics\ArchivedEvents\179382193100001.dee975c3\s
Size 345B
SHA256 1d617b1ed432f2ea9968e7326418b7497454a9219fb09f4dc17c86fddba0113a
MD5 d4fbd6d19a7063518eb976b81a6d1433
SHA1 0ba0c6a1a718b7a0d278facee7bd7b1c57abb81c
SHA512 dc232d98bde94fc52d70e73700a864630aa17e0e135f9f90db43fed44fdaa47d421ff3f4ba88f019028ca3ee7edda4677b13b5c46e065473069de72a2d6bf949
TLSH
T133E020B2C5EB7471F9A545923C6534703A290FE4AA56D8AEC4F0649C120A34CF20D1F1
MD5 SHA1 SHA512 TLSH

Submit Download

094af2c9-2e4a-46dc-9274-bed92379c125.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\094af2c9-2e4a-46dc-9274-bed92379c125.tmp
Size 26KB
SHA256 b380b4947bd0ee4f2e140b6121d9f694999932877a65b355db385cec597a0b30
MD5 dd2c6a403145aeaf453213c770c2585e
SHA1 be765b620c55048e5cf63c7c046ace48b5783cae
SHA512 ad9cc75e6949c02d71d692321a55318c7ae450deeeedf097f737f1279d42999d3aec7973883e6a63a2016c4c0c1228a3051bddde3799089841c3296344b18e72
SSDEEP 384:O9iFdQkUSvL8No8TUNTUlIlKB1LS6w6IZ/5t3f+6fw3PqaaX1L9tL8k0IIly:rFHL1wgcOrZ/5FG3PqaaFBt30Lk
TLSH
T1FDC208F268D7983BD9AE4B43B33D2E029EBCD053F5845A50B788591CCD8A1BFD346911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16ee1330-fb35-4931-9b40-7f8610e39773.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16ee1330-fb35-4931-9b40-7f8610e39773.tmp
Size 18KB
SHA256 3cb3988b69ad634bbd03301e2d74aa1db1851a6c1f82731714dac731b5a506c9
MD5 78b6ff2b0382d468a8bc7ff7c792be8b
SHA1 5b36bc00ca83422cc4a96488fddc792c66bdcb3a
SHA512 a782e0d6004e55a097b222f78c2092d45e82ec7f9260b45e53d2b8f537c2c6a734646cb035cfa00f7fb279c765a462afc1c29d58a0021f0d4e3182091bcb6d96
SSDEEP 384:PQkUSv+8N4KB1LS6d6IZ/5t3f+62PqaaX1L9tL8k0IIly:R+y/rZ/5F4PqaaFBt30Lk
TLSH
T172827D7178B86C7B4EB39951F25A3643DEB09067DB881F94DADC6F2C06CE2C8135B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d3d79a2-1fca-4374-8d78-383be153ef33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d3d79a2-1fca-4374-8d78-383be153ef33.tmp
Size 8KB
SHA256 6a75f777ae41e3987cabd3c60adfe1ac1b79ff13ec049f2b666e3c7a1381eb0e
MD5 c3618563f078ea863fec73504927eda6
SHA1 04a19753f42fb35ed92641f3f486f92230f68779
SHA512 a5441ff69c32c0bd0088ee4de79fd205945233ba8954a79fa7ab22fe50f324cc6555dd21ae5202b598b05f64a1c6986bf4a3c51c4bcc069c080971e609736ad7
SSDEEP 192:VGNW6QhLFQmiUyM3yzVZ/5P1plf+oOEVVU6:VGNW68LjnCzVZ/5t3f+KTU6
TLSH
T1A402E834BCA87C7B8EE3AE56B5473B239EA4202B9A946F95C9D81F1D01DB65C1306422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3540d616-9a28-4b6b-a087-b03d393ed51c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3540d616-9a28-4b6b-a087-b03d393ed51c.tmp
Size 8KB
SHA256 462197a7873221a3a92631166a1fd092ec1ad01bfdc2c731eef2bd1e3b993a80
MD5 5c5e9c923cd2298ac3976ea95b71c777
SHA1 8a8333bfca8fbe585db6f341d85f1ee09fb0560d
SHA512 1d2caecb656ddd3f300a60f5a81cc27d49aa367f66a2bf30ce20dcfe880c752afe50f0e54069d82fb760432e3bbc0027c7e24eb9016ec7af989379d01c7051af
SSDEEP 192:KGN56QhLlQmiUyIymVZ/5P1plf+cpr6/1qg1U6:KGN568LDqmVZ/5t3f+6yPU6
TLSH
T1CC121A3578A8BC7B4DD3A995F08736239EA15127DB886F91C9DC2F2C05DF69C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9afdb7c9-63f0-40a4-add2-0ea4123e9fc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9afdb7c9-63f0-40a4-add2-0ea4123e9fc8.tmp
Size 18KB
SHA256 f705d3e177e8b72c8607bfac720120c0df4a66bd1d5bb2de3009d3c936b7da13
MD5 0d60ccf7286c6fc20fb5daa7c4445b52
SHA1 1a56b12a3f222e2bcd1c9bfe0f7096ae8026064f
SHA512 eefbcb2d748b75ce484c9dd21e77f352e084a69328b3022de1381def73c64d6e8b8868553034bb3896ad1ad31091932bb715e7eb0846a27f546bec28aee69533
SSDEEP 384:dQkUSv+8N4xB1LS6d6IZ/5t3f+62PqaaX1L9tL8k0IIly:H+l/rZ/5F4PqaaFBt30Lk
TLSH
T151827D7178B86C7B4EB39551F25A3643DEB09067DB841F94DADC6F2C06CE2C8135B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9ffa5510bd8eaf647858e337946c3d8551cbdca3d5f58e2d47ed03bf6e04f43
MD5 e2b553a32003f2a232e334c2a7862a8e
SHA1 cac2df4649aee9c08574409d20cc837c1704412b
SHA512 fbd8879ece0c87ceb91747877c9eac2e13992e2df5094b3111703cdd532dce0e6df3dc8256243b2dd5219343938dad7b5cf8c47bc1e74c37ca7dc731914ba4a7
TLSH
T143D02230E3820C80C8C0303A2F338AB300E0FC20C0AB0F000CE8A00CACCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ddfb263c192f12ad316454ee1c617fe2afde1239c1d68dc9e5bf0d864f9cbf2
MD5 925e9d1b6623e8176bdf3f18aa051198
SHA1 d96ce372c5b1b00e786b8b194f0b192ccf5283e0
SHA512 c3f57164fd3f5ccf0bc39a9f6b7e92d801c6e506910373630207eabe860dd8726adad51c883190b5638515adc6c3ca5c456072eff9fcf7751b6f73effcb3c08c
TLSH
T14ED02230A3C20C80CCC0303A2F328AB300E0FC20C0AB0F000CE8A00C8CCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

32ee70b8-82a5-4a51-83e7-262137db3c24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32ee70b8-82a5-4a51-83e7-262137db3c24.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a9ab0ab-af36-4554-a011-a0e6c5a0bdda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a9ab0ab-af36-4554-a011-a0e6c5a0bdda.tmp
Size 10KB
SHA256 b266f0272b7943e90119af442cbd7238633858a8d48e57ec328309525c8f4e5e
MD5 20604fae2b70ee1e8b9fa8b411a19079
SHA1 7fc2326de06712c6d4001df5b252a36db404b9b7
SHA512 c7e4940bc16b32bdf9333a6ce598acabd53fd609601d6125efd203fe4d3843137bbfd9133204ffcec7cf255e33251df506a64c73e7f2fbc99acd321a87843597
SSDEEP 192:sxZsR6Os/f0spoWcIdpEls/W6+WNbsj/Y0t39PkqIgrJ:sxZsPs/f0s6WFp/bE/5xt9
TLSH
T1222295526E24A93B8CC7E209FB25BF53D6FA503291D11E58AAFC861C05E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

599508db-20ee-4f03-a48e-674e47ef212c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\599508db-20ee-4f03-a48e-674e47ef212c.tmp
Size 10KB
SHA256 0242d258631d556c9c4d6dffa96aab7bc1768a2164e7206e43afad93a6a43858
MD5 2278faa986dd88bd3c30cdcf3a4dd02b
SHA1 625b821cfdd54ec7921db104dea75d8f05b989ce
SHA512 91aac60fac064b42d564554e7789a5d1255be2f6ce62424b21009f340f8c668d75d97f0618b8656561ba79459865ff5c1a7783c22b7a0f311752e011e7163510
SSDEEP 192:sxZsR6Os/f0sHoWcIdpEls/W6+WNbsj/Y0t39UkqIg53J:sxZsPs/f0sIWFp/bE/5xs/
TLSH
T11422A552AE64A93B8CCBD21DFB15BB53D6FA503291D11E48A6FC861C05E66DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77ae7cfd-a315-45a4-b17b-1fdf75c13253.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77ae7cfd-a315-45a4-b17b-1fdf75c13253.tmp
Size 10KB
SHA256 025642bc9695fc449126a0a4c06aee9a6cd66340a63fc9c3da2af2897fcd24c7
MD5 a157c419b7309369a115e652109f9edb
SHA1 f297430e6ebe5c761df8e41d43a665f7caa3100f
SHA512 3aef4030beeef606d7a2bea390348930079539b4a58c5fa40aabcf7e8f00125f6207e64b5bbb08c4be34fff131c014adcdae6b75b57c0f7a9f459f0545feffdd
SSDEEP 192:sxZsR6Bs/f0sHowcIdpSls/W6+WNbvUXY0t3NIdkqIg5FJ:sxZsEs/f0sIwFf/b4X5xN8B
TLSH
T15232B552AE24693B8CCBE60DFB15BF53E6FA503291911E48A6FCC61C05E76DD234740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b9d89ea-2f7f-4ea0-8b88-24ea3e459689.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b9d89ea-2f7f-4ea0-8b88-24ea3e459689.tmp
Size 28KB
SHA256 bf69053c8edc2c2866cdb8f0ebae136798158fe0286e4fc3c17b347e4e02f8c6
MD5 308fc13ee5802b1f342f3bbb648d678f
SHA1 edad2337deac108f495a315c1d2140b40366483c
SHA512 1fff1f6168091a58705c456b5b7cc06b01497bed83b021f7adc5fe150a80f5d5c99f90cb8608c92666ffb1e46fd5dfa0f81928b9850b43fc92bc0a22ba1d302f
SSDEEP 768:XnbN98wh2cYWRmYQQOs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mHLl/eA0ZUYroj4:XnbN98wh2cYWRmYQQOsu1jaKmHLpehZp
TLSH
T1C2D21B3B240CCB7E4FC05AADDD166F976E9802D7A6688D4047FE894C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 20KB
SHA256 9bf2da7d12a788cfc0bac3d886f8ba647d43ab8153416fa47a266ae125720e1a
MD5 5365fa04cc2c94412899cd1b1e494544
SHA1 e2c3d661ca973eb0fe671292717c6d2d73f22a25
SHA512 f2b11b1127b5325d87bf57b82c65c6a2c3e23cd769fbf2090490f107f496e8ea4ae26f1f7180480fa0f8064ff86d82473d89dfdbbd9ba09970f16dd32ff4a6db
SSDEEP 384:NmZ1MmOatiK8KZ1MmOaAnJbhep3gf4HeYNg7TEN:NmDOatr8KDOaAJqeYyn6
TLSH
T113926D29E7726FD2FEE0467964E6D743B3A3764987A3654138CC9601BBB03D0CC0E296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 74KB
SHA256 70e4d628843c8aa128f28b04653deba8bc351b4b868d4d6e9ada67a3e2cfb400
MD5 5c1cb34c1dd3766326afedfbef9f4aab
SHA1 da51bf4e974c86eddbca6e3b7e07967b21a08367
SHA512 a42ca1fe34d594fa550c9f806022d3c3674a7f03ccf0359b1bf623883b807fad668fdb2a05e89e4335a98a88bb94a8f9b47423e22f2bc9d882899ed6ff26de5c
SSDEEP 1536:sl9xog1rbd61Os/oqNREWWFkSXI0SlxUbW8uIl/7SpLP/v9:s5Fp6l/RvWFkSu/d7Il8Pd
TLSH
T1DB730260BEEE2E1A9C337F0F5D94C9852562FE9B60CF16EC4FE44D98D15C1E682402A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 23KB
SHA256 15c923785828d3731fb8287a8719c992ce8c06761efb1ee9fa60b743d2028ce5
MD5 6a5c3a30bc054625958d28ffb41214ee
SHA1 50c581c41ecefb68b9879c14a22c693b8f6c6303
SHA512 7f3c8ee86e7a246d366d0e43fe1ab35f32df6c4dad5f1c9ac1ee17c90c7c79a83efa4ff244d93be4293a21c5d713e41f2324830841bb25e8410d9327e0174a66
SSDEEP 384:wgJBCoSGf41HlgH+w0k8aTvuJjxFOTutSARTJOzb5DtlrdC4gcKCZ/Rh8M3o89cV:w0c1HaewsaTvGjQ3RtlrdtgjCZ/RhplW
TLSH
T148B2E04E75449BC4F1BDB00B993E672823DFE4A1E1625BAFC535F88589503BA3C24CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 23KB
SHA256 89c8e0669dd411b4f91f79771522f9686bba1aca7f1c870cad8901c021296728
MD5 64120364123eb8e6647ae8b7700c3ba8
SHA1 849f45544b09d35ba1e1dea123a736f24faf3891
SHA512 7ef9ecda7e67b2f16667f2e31048add89e105631274e53343f249c02ee06fec0a85d8a244f587e3bd8e0fd61ba7eaabfd2a5de69702c57f2b7ebbdf0fa44587f
SSDEEP 384:SAQliXhseKZE83ijBVojv3WGwFWBaSodQ1N2LHOkYdY1vwSupm6nIgkxv1ObK3oj:SBEXhsxZE83ijBVoj31odQ1N2Lut4vQF
TLSH
T1A8B2E1FD0FEFD811080B538BD117A18B683696EF7B0309A4A8A5238C96C69BDD733551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 393449c8e7de90ac650d6202bba4543c62e1a1b61453753494004035f05d149b
MD5 c2749024446265c0e4db7df27e364896
SHA1 6379343186fc5aca6a4829718ece41f8bb003482
SHA512 f4e1cfdbaa69359396dde066164fa356e8bf010d982a6954da566303a4fc6ee68208b61adc99031f15fd25a17a60bd0f0f4d5e11be11ad2028352d03d9f68773
TLSH
T155710E4344AC0194DB5C6C3967D66F873830D6AD7E875F564040F0BFE82F39A9326A45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8b8e511fbbdee2230efc715a83c08fe12d74f4785fd7e7f56e5ec103323a00a2
MD5 dc55512810b1af27e9cdaf8178a8f23a
SHA1 d62d185ec781761b1c3bfa26b91d9ec88d511a94
SHA512 618746521df653bbdfd79dbb993f3f59ef3d06ebfdf974c66e8110eda93196946b21b4cc9386ed69cbb76473d936d513d99ceb7a069a42a03f7a3cd546b23098
TLSH
T11251DB83486840D0E76C6C388BD66F877970D79D7E8B5D868495F0BFC81E32BD32684A
MD5 SHA1 SHA512 TLSH

Submit Download

321e7015-dea8-44b0-bd4c-6d11b41a4108.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\321e7015-dea8-44b0-bd4c-6d11b41a4108.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

39867b2d-bc2b-46be-be16-5b10d7ecaf97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\39867b2d-bc2b-46be-be16-5b10d7ecaf97.tmp
Size 6KB
SHA256 b2e6e550e5ec7a7b190933fe7a14f3683f9d1238f21a4112e98cdc8948fd6ebb
MD5 22bd1f7e26317e07c284d00b6651bb17
SHA1 6296d7b60826e77c8b8253724fb7f92fbb18f21a
SHA512 98780748103292eb94641b75edbd60e3f395cc7d1cf4ee764e76a9e67cf11afea67fe325c1dee7e66c4736f0f3ae9a3cbd519817d36c6cff5f9e6ed44a60aa17
SSDEEP 192:DFjTJjvjSjz5J+J3YOjCJj0Fj5GjEjhzjh5j9jBWjqj7jtP7ePZjh2lxc6Xj6PRX:DFjljvjSjzn+J3YOjCJj0Fj5GjEjhzjm
TLSH
T1A4D1AFF2C7F8412DC91256F06A14AF2FDE2E155A42683C068CD8EF8ED3F14B1A38554E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63527a74-1800-4757-a397-2b9992664e19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63527a74-1800-4757-a397-2b9992664e19.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 afa4a65f1f91a431ab0e754cfe23c3b365d0c0c7d9dd9eb65f07d30ae806593e
MD5 1b27cbae583d23caf786bd5089a3a09a
SHA1 019cf7510f97ae3130b2cfa9216a43ee0412db63
SHA512 32e51219a14d0060e92bfbd7efa84cc3b1e5c9c00081c66f59f8b3dba6e59d53bae027e1614da7910a5b9f7dd978d5f11dca50eba358f4ae0c6d4eb266df7911
SSDEEP 48:KU+IPK7ywYYI/KJOs3yNPIBKk4sDyIulSewsIkYH:KU+sK7yLYoKJOumPyKk46mM
TLSH
T10E912091726B03803A7E240C52B88B6B524271F37014F92F3FBCD4A69A67E154EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e41f9ef8-e708-4d51-b5df-dfe6c2347cc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e41f9ef8-e708-4d51-b5df-dfe6c2347cc7.tmp
Size 10KB
SHA256 150039f6c8d4654826c64be188bae9463ba20822ad13df17acba70d9b0b581a7
MD5 26abe8ae11b77194b04cd78cbe34eb7b
SHA1 3cec2d33223f9aebd052dcb276cb9858cfff5334
SHA512 df166e3b1ae511203b292ef5fb84141ee423c6fd256f0af387d5bc4e2fc93f96815277dc8328b07836eb69da4ae5eba3f86ce8f57649a6cc89b5a0f64811187e
SSDEEP 192:sxZsR6Bs/f0sHowcIdpEls/W6+WNbvUXY0t3hIWkqIg5FJ:sxZsEs/f0sIwFp/b4X5xh5B
TLSH
T1E822A452AE24693B8CCBE609FB15BF53E6FA503291911E48A6FCC61C05E76DD234780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

600df43d-8fc4-44c8-b6a1-c3da3c5c149a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\600df43d-8fc4-44c8-b6a1-c3da3c5c149a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2539c63-f85b-43d5-bc9c-1690d170a8e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e2539c63-f85b-43d5-bc9c-1690d170a8e5.tmp
Size 18KB
SHA256 651ef8f4a801860f96ee73ee8a8b57e1948ba744308401d4073ffb8ebbef360b
MD5 98b5643b6ff3b6ee7a0ca07f0e6405de
SHA1 e298d5b6836e8caa9eda5483bf520699a7332999
SHA512 a1cccba502e048af9c910a84a1cc8d414b356c206600a9da94117e16cf7b20f54e2d67762a795750527782497bc24e04807449321d13459b01e7387baa671d97
SSDEEP 384:2QkUSv08N4NB1LSvd6IZ/5t3f+6tPqaaX1L9tL8k0IIly:W0BgrZ/5FjPqaaFBt30Lk
TLSH
T125827C7178B86C7B4EB39551F24A3643DEB0A067DB846F94DADC6F2C06CE2D8131B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fef5edd-21ce-4b5e-b0f5-c3f7ecc3a8f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fef5edd-21ce-4b5e-b0f5-c3f7ecc3a8f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5fb09530-9ed9-44f6-aa9e-154ce517460d.tmp

Path C:\Users\Admin\Downloads\5fb09530-9ed9-44f6-aa9e-154ce517460d.tmp
Size 5KB
SHA256 e2a2dc572e88c2fe523b36cdb04a5197f3bae746e93e32e1ac0ba6ccf25dc489
MD5 6d5ca4c1dfcabdc0a1485cb080b33ffa
SHA1 40a31c8bd0601da4c2b0eafb2d09241f3c2516f3
SHA512 320747ace065a4ce3d8567226b363764af08a8208adb70fc193259e4e9fd772b7f1520f6e1a93a5e8c23e69a988a2e97b5ddb8c04b736bfc6dcf2a7283981ddc
SSDEEP 96:sw23Tk0DQ4TOwP4+daZDrTLZ3jB/KGEwwxROBCnt5KlYphMI7kVvhqWP6cr:swqQ004TOL+0rH1FLEtsBCtWRh9r
TLSH
T146B18DA08AA4A9D188140A71E4E9C067EB73B94E3DD19E477881B6059DA8846FFC0A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quicksand.rar

Path C:\Users\Admin\Downloads\Quicksand.rar
Size 24.3MB
SHA256 de5497e7d326f0a1c4a2b0b1d84399b22242efb2a9f8746f44c6e6c8071a76bd
MD5 d1fef4516d39347e425e8ba9c3180866
SHA1 0c340ffa1fd4670a356466d2a6d717c9e2e6cb62
SHA512 69f257a371e9e80e933d506c7d0af4fd70a1fa8d2f9c3a8d3e4b0c02089f991c07564fdb3c5dbaa01d6d4acc61f8ab58a15ca5164dcbdc17d4746aa9c55430aa
SSDEEP 393216:lS4+uY7hsWUnZSzrum/9KaG2ZiMcagNJnAgW6UL5dET2nm2T65E76Dy:gMY7qLq8OiTagNJnXWDeynl+5Eb
TLSH
T16A47335B421F0F65E844917EAAB5DEB64880FF4C11EB84108778E77274B8E19E1F39AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quicksand.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Quicksand.rar:Zone.Identifier
Size 462B
SHA256 c78f4f6a5cf07132d41fa3f27fa6e83a152b81ed12bf86bf5e44eb384c183fe2
MD5 3255682f6d5950fb73cbe3920a306ebf
SHA1 551a0b108129504765837ca529e191574d00f853
SHA512 0ad2eab1e34fdfdd917d4901aaa9a9f7c3b6522f79930b597b711e5a57dad216b1f96ebc3309d8a8d37a24ef628f0b30cc5b4891c71b18e5553b6bf73b33bf11
TLSH
T1E1F0DCBFCA40A11D0409391EA26AF27AF213416639F2848EBC3291DF34D0170CEC6E3E
MD5 SHA1 SHA512 TLSH

Submit Download

Quicksand.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Quicksand.rar:Zone.Identifier
Size 462B
SHA256 c78f4f6a5cf07132d41fa3f27fa6e83a152b81ed12bf86bf5e44eb384c183fe2
MD5 3255682f6d5950fb73cbe3920a306ebf
SHA1 551a0b108129504765837ca529e191574d00f853
SHA512 0ad2eab1e34fdfdd917d4901aaa9a9f7c3b6522f79930b597b711e5a57dad216b1f96ebc3309d8a8d37a24ef628f0b30cc5b4891c71b18e5553b6bf73b33bf11
TLSH
T1E1F0DCBFCA40A11D0409391EA26AF27AF213416639F2848EBC3291DF34D0170CEC6E3E
MD5 SHA1 SHA512 TLSH

Submit Download

UnityPlayer.dll

Path C:\Users\Admin\Downloads\Quicksand\UnityPlayer.dll
Size 21.9MB
SHA256 a9e114abd8184afd464ca351f6985ff46d62458fd768394d598a58dd3c9dc6b4
MD5 7b6e3dbc097186da32b87eeac8c4a773
SHA1 404eb4a6354b109d56a506e98a6eb57689593e19
SHA512 93d9368494aa04c111b871f67024d4429bf4a5f5d865cd767ed01279cc57b5cdd3a1843200f1a634bb184d360d4d8b9d533829f2e44a88d3ce67fd25abb86d5b
SSDEEP 393216:/8unNWii4ToPHu+DnLOYRnhDZs5FadNBJH8G8ZjvdHXPNdxEiP/tH:FUoldx/t
TLSH
T166378C6A61B840E4D47FE078D66BAA0BF7713849072047DF12E012696F73BE51ABF760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quicksand.exe

Path C:\Users\Admin\Downloads\Quicksand\quicksand.exe
Size 637KB
SHA256 51a8ed7dc1cb0efcfc4e5a4e62fc0b2cfb5af4d424a8c16d500b6ad0a8a8ed85
MD5 05f0e313f3429deef5c90b1226b8151b
SHA1 9a78a7b957f47525be75fb928c28f69da42f52e6
SHA512 35c237be6e1ddc7c36def4b6eeaacdd1056cacef9da19b0a3dbc43c3c012cb9356477a46930ee627b654b369b2b5391583eb08daeedb395fb4103c8146ecaf92
SSDEEP 6144:79fYunoPZwN5lUSfI1ftMgKi7sSRtpMeK33nG5Ofer:C+o+t4Vr
TLSH
T12CD41DA02A98E8C6F311CCB490F1DFBF84F9AC350956850695FAB6BD9B3E3793C15112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.AIModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.AIModule.dll
Size 33KB
SHA256 8734dc1f074b6c3341d4d01327c9d6eec9724ad9b1af5e2f04d16f78831337fb
MD5 b0dfddb2afce74034ff87a348b66a4c1
SHA1 6e3841f9ecbf5558f90703d1582fc0b5b5286d76
SHA512 985a99b99426b88a8b1123f70456ff82fff2e51ffce43711a3880bc47e2e4a72cd2a9c9ad2a9396be8299cc4826df71e80ca82cce277d9d49fe5b241d700549b
SSDEEP 384:fODVfJNNRX530JL31Dgd5y0WjB7d6ungg7bissL6EjYRLuHdLiU8NLDIbOmRicB/:yzkt1DavzuT7ThVNLSNwSrK71G
TLSH
T1BDF2E6E8A761C1FAD95D2735F0F043A01B34C2029713EB47137A617CBCBB29D5662AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.ARModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.ARModule.dll
Size 22KB
SHA256 a4089630713e161a1537c376917d6ae9acf40334330a79c1d9c3252c736c4004
MD5 2f79aecb9e3d7492aee8b1dbad1a46c8
SHA1 d3d80b30aa45cfdfeafd60165972e73deb22abfc
SHA512 097ad7a5135db9cfb3facd06c8126ea00560325a76b5c5020cfeca4ba8e300289a6ea66759676683540fc3fbc04656076bfd9e8b3a0a76d83e3a37bb6ec1aeec
SSDEEP 384:5IGnAhPSOqSrs0uZGgJciYbM1NovuzruEHtB1B0ujfB4B6qK1O:5Ens/ZGv4rovuzPtBUujfX71O
TLSH
T151A20A9169E5415BFC8A0F7AC4B182042670D8929A63DB4A179C30BD78733F46E267DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.AccessibilityModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.AccessibilityModule.dll
Size 8KB
SHA256 329be13c426204876acf9ccf4fe601acdfff505db77fb3fcdeab06c834de3f5e
MD5 7c01c1d5584c0544b8dc3beb5751ce86
SHA1 028313f9351174e0675acddfc7076c5a0ca891a2
SHA512 4a2a075faa152528355c79c294c1cc0409f0ce35b9a490be0f7104c93e2cfe7ae4d6cc10fea7709c6d641726e1d31fb455562fb6e4f35e1614615848dc5a0924
SSDEEP 96:SDq2ws8CXSF1pdIr+4bMdjDk8bDwyOt1xish03AMs7QbM91zwQm0SL:qqXHpy+MSB/wRo3AhqM91OL
TLSH
T15202DCB57BC01597EC6A0F32947A83C079E0D463DF36C12A0BCE61B6A5390DE7D226A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.AnimationModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.AnimationModule.dll
Size 79KB
SHA256 7fdf94997ecf5181d06a4f2057e9b9fdf65c9e764235d40b2041ec0699686a5e
MD5 5b14b8489c1b986bc15b22bfadb18082
SHA1 d3767d58c7ad399562427aa0240f0fb6aa5c90ef
SHA512 f9ddcad1ba270706c2b5fb352d9f9cc11573f37edf4334d3e824a2ece773819ac280b2fd818c18948476880a93f308b3e474aae59b9d259562650179e4389241
SSDEEP 1536:VoIAiqYUD7ccEofNiAzXIIQ5rhZZ4sNQtSwSh/71N:uIAiqYUD7ccEolPIIk/X40/xN
TLSH
T15083F82DBFE15419CEAE1739F4B803140B38D9425127EB6B2276147C6DDF3B46263BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.ClothModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.ClothModule.dll
Size 11KB
SHA256 27534ed90e02d7ab2ec18e4ea7ea2ff41918d87d3172777160a605f92eb42f77
MD5 625dfe515151edf6097b76e9b93d71a0
SHA1 3def1717ce2c57d701e2afc23ca078c90acc8f77
SHA512 a4273a253ecda81ff3119e0305cc0a94174fdd4c2443befde3cbf5ea3895087a49d94c0ddf4220a11150f608ca3d7ab07b0fda19aae9126549ead995f9aefd99
SSDEEP 192:L6Qn56OWyBhK1sdLPJFXT8CxZSIlG4k4muHqJqqOXtqM91aZ:zOGKudLPJFXT8CxNlG4RmuKJq19qK1a
TLSH
T10A3251F47690C29BDC550F33E47A479276B1E112EF72C6140BBF51E8B87A08C7EA19A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.ClusterInputModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.ClusterInputModule.dll
Size 7KB
SHA256 2d0f7d7ccb9ba21e05f2c00ce624db4b1cdc8331a8b0aaf5b7777b20047319c7
MD5 4849dfbed4449fd7cfefb7e027c6bd2d
SHA1 4f0eb3972fec4cbfc4431ff7d48edb1687eb209d
SHA512 b7669a19c7f6d6f8d2986ebe82c7531bde9ebe30e63b0cb2f02a0d7547543d947b8a40bed9e522c489d9d8f9136fefc3656e17e23dda0969652e0d76d3f36606
SSDEEP 96:DAmtaEspgZM9M4tf4IUneSOD7QbM91fEQVdV0TIdC:8zEjM9M4tf4IUBOHqM91leqC
TLSH
T186F1EFF1B6D41197EC559F37947983813AE4D423CF32D229178E21B5F8790DEBE21AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.ClusterRendererModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.ClusterRendererModule.dll
Size 6KB
SHA256 372cbd64a29fcf6e946906d374e1f723f4d825a91c7df10d985f54893d7eea79
MD5 1cc9d3c670eabd79e366b00500bbcde5
SHA1 2ddcb395ab6616051f558211c6d31537f0efb762
SHA512 f2bd6acf0f5edce4082563266705e771fb5452172575108e2334ca7217e27712a0ffb549802127ea7767e80307607d283f908be562474a1a9b0ddf2d5c4116d4
SSDEEP 48:6OWWUUvcO/5LU3uKdFakVsrz9ndm7FZ7hwjqjTByEVu1C/TI4frAYx6bVID7n1Ht:iSvpxAR7srEF7QbM91Tx0dk0gIdH
TLSH
T1F3D168F0BAD5119BEC55DF73947983813AE0D423CF36C529079E21B5F83909EBE21AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.CoreModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.CoreModule.dll
Size 668KB
SHA256 15cd2d1758f57f85818786092e0db0558e15e8547c1808a581cf767b7b5cf7e2
MD5 59c456b3662f3eb512db29bcafb1d63f
SHA1 692ccc9e34f660dc041b60c7a75c1b3eb4c3d0f3
SHA512 e3e5d3c227e035a8f9a232c96daccd072c5c29d6879fb35a7193c5385d6d35603bf7e0da6af8bf18b52627b49352bbd01f3a6106927e7fe9ccc0e855863d7a16
SSDEEP 12288:GFimNUO3Dn5bhYoMvbQARCFtrCOyRy5t:GFiuLltYoMvb9RCFtrCO+ot
TLSH
T1C3E4394877F9A8DBCF7D2339E0A144101B34E1052313EB8B15B561BC2D9735A4E6BAFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.CrashReportingModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.CrashReportingModule.dll
Size 6KB
SHA256 7c8abc77e290782c886887a1f452fcba3273208732105bf47bf7df0ab306ca47
MD5 678aa7fb5284974bca52fc087c2a5850
SHA1 2342e48e36738b2f53e7af0a01e38c2dfc728cb6
SHA512 831f1ac774cd600ffa92e643aa88a43abb8c25cd90e591061dac5c42803c5334c45b5f3fe2605ab2bc5836fa7c748f53ffd62e95da775cc34e2ebf10bde972ec
SSDEEP 48:6b99zji7dFCYiL6/FScTbRfnnLxjxtjTByEVu1C/TI4frAYx6bVID7n1HOO48nqi:49PiCyFTZnnLV7QbM91Hlrz005I/
TLSH
T1EBD178F4BAD411ABEC55DF739479838139E0D423CF32C569079E21B5F4390DEAE21AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.DirectorModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.DirectorModule.dll
Size 8KB
SHA256 8e288c5c689b7d3a5b9315c4fefac8b3e823934c005b59bc6337030b49bc2e93
MD5 41f1b596ac63b5ebe32016e9e318acb0
SHA1 8fc92527432cb5537f2809ed3e43b7c47d10f5b9
SHA512 4239532568355241014bdda5d295e9bd282ba4fd53839df9572afd8978de653d53ba466c7db512989aab73a6ac7b5712ad4fc0f64665866290a8ce403d005cd1
SSDEEP 96:kqCEqrMZHtDf3gTi/k/GE0M1AiAtgCZj7QbM91/2VF0fl:kqO2tci830M1AiALZnqM91tl
TLSH
T1F4020EB176C4909BED950F33903983813AB0D923DE37C329079F12B5B9381DDAE31AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.IMGUIModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.IMGUIModule.dll
Size 137KB
SHA256 d4c6000269c53426087c5091143a3e144afa344a259f3d47d6720c13bfb91308
MD5 23d3b15821d2aed6f56bc481e90f3fa1
SHA1 4dc829c195688467c80d3775a549202bae6bc722
SHA512 947188a02baf1d307ad5dc23d4d129a80a5821df3b40a726ceeceba661c38cde5a26856331bc1bf360fa34f236cfad735ad93ada21e69dfbbae637b95f42639f
SSDEEP 3072:EKaI0Z0ehZbEgjurgfcdNlPoSWfr30QcpixK:E3I0Z0ej72gfcdNlPoGix
TLSH
T172D3396903F9842BCFAD23BDD8D11104F3B1D1066217EB4A596850FC399B3A6E9227DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.ParticleSystemModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.ParticleSystemModule.dll
Size 107KB
SHA256 9e5d9a8f8a64e865fea0451b09f00e3acc36a4a32917cda417d64e428f438f48
MD5 e4e4ce7ce21a9c3cd30aa44650fb6e46
SHA1 04334f655ff45b513c22c32f057de9111e6f1ea4
SHA512 16577764a92a17cdb4ea8acdb3117dc136a356a85d9423952ad40b1726fc16ad8d3b4de5c2df22062ff5c3b42f781a5c9231265af82f328798447b75b7492c09
SSDEEP 1536:UqSJ6dVH+waqSoTaztgX9vjN4AKWaxHk7E71w:1vJyXi7Exw
TLSH
T1A1B3D8F957AAD62CCA8E3379F0E5122072B8C549B013E748177851BC0B1778BA57BA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.PerformanceReportingModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.PerformanceReportingModule.dll
Size 6KB
SHA256 1b17972c500070de66ccbfd81e8395a0e14b4f905e101e051588a16cd66f962b
MD5 f072448607f313000adb0bc5cddcf3aa
SHA1 4426a7b4272cacb0e1b1e8020bfa1fff2e373d6e
SHA512 266890569c949c858784d40a5f2f50116516b7731e4173677b5b160f6af9fff5b49428ca7b0b292383212c4040e22ef47fdb6f7ec27f23ddf7dc3aa9764e7d29
SSDEEP 48:62q9I1+TtCYiL6/FScTs6ubRjTijTByEVu1C/TI4frAYx6bVID7n1HOO48nqnztE:zsIZyFTsu7QbM91HZH07r
TLSH
T1C1D177F4BAD511ABEC59DF739479838139E0D423CF36C529079E21B5F4390DEAE21AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.PhysicsModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.PhysicsModule.dll
Size 67KB
SHA256 d5897fd4dba3f188995ce42e9f9f26534db4c0608cae8feed0b195c8d088b479
MD5 90ed6974b0ce91b5535f6a3c544d156c
SHA1 daa90abea5765b8276ed1511a1f5a061ec06d2f4
SHA512 5c6dc6f63c929b3b4c11aefe1784cc094a8c73835f01eedad0dc0f47d8a5a8cc6f7bb1839e195eb1632e752bf198d9c34a3a5a18eac936fe440a8102547928cd
SSDEEP 1536:AoYriDf81a/8f/sPcsbD77VKHG55/1L9dYH2NL/f6VuU0ZUwxv3UG71W:A5riEa/qErBjL/3Uwx8GxW
TLSH
T1C063B4CCEBA2E41FDE5A1631E8B206A05134D1147393DB87A9B860BD74FB3D853A25CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.TerrainPhysicsModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.TerrainPhysicsModule.dll
Size 6KB
SHA256 c76b95631a1e6d5c86ec28c4c52c349deaf044a41452338d72d79648d9baffec
MD5 3ffce800d09a4da51737b4dabaa20495
SHA1 bd7b2a0bbefb1c7256bf6b8c457464dbe79afa2b
SHA512 c4676fbe69dce0ee22eef0b21d6a1fcd8b5d6ad5dc04aeeefcde85f78c2725d6f89bcdee77cf21d623fe2f9d1d69e812630551be43cd4f2302a4e1927ace4864
SSDEEP 48:6nyhedy7VhhKiIyVXXTjoTjTByEVu1C/TI4frAYx6bVID7n1HOO48nqnnaOPulBx:ThxpIoA7QbM91Hxrr05p
TLSH
T176D167F4B6D411ABEC599F73943983813AE0D423CF76C529079E21B5F4380DEBE21AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.TextRenderingModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.TextRenderingModule.dll
Size 24KB
SHA256 517ea32f5d1a9acf1cae36fca9e4c864dea6d7be24a4b6319543eb0d4b19e23d
MD5 818b2ed30b62e4f9efbdb0bc9fed843d
SHA1 04520732a7486b0eb41642f32b94316674f9158a
SHA512 10a0921fda02c8cf1d9f17126c23bdff5b04291cf245233de681c9471ed4ea1be5ea99554e269b60f900b7137c1c32b31a4183aa948c6168d4328ed4d93d6149
SSDEEP 384:LWcbrqgZjGnVvAyAn601JgmiONaQEPSjCf3jljUQA7yzoOyOxmqK1x:ScX7SGJgmQujCf3jljRy71x
TLSH
T173B2E6B46686815BDE9E0F76E47043511770C2036A63D7A612EE907868BB3E8DC227FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UIElementsModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UIElementsModule.dll
Size 162KB
SHA256 3266fce18d71f010f130384a603c1badea0ba9f115dd8b6d49c1cdd09669985e
MD5 c68221db73cdd49fb0c13dcd705e1830
SHA1 97bb0a5310593a1c332ebc096b28dc2f40c168de
SHA512 1c506eca9eb697fd132ce46c1659c5a187a5adff9cc26c0fe1fe14eedbc957827d125f12901fefb53aa678d701d628501f1a2566052f7d860ef8e5a3d21827e2
SSDEEP 3072:d/cDO8hopimOUo0IfiXCHPolmVGByg8x/x7:cMDOUo00iSHPolNByg85x
TLSH
T1D3F34C381AD9452BDBAE077AF4814120B7F5C147C653FBC56BE170FC1CA3BA2A6062D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UIModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UIModule.dll
Size 19KB
SHA256 0acf1915e1fbf2b70c57e068796d3adf32bb80e63b225d4fd16f19c50687491f
MD5 3f2013ca3c3c27f7bee2d10df4fa5b38
SHA1 1d0592187afac4cdba2ebc2d29754e8a12e3670d
SHA512 946c6e0979c4b63c28a7c80e637bc86e4aa96fec73ee06eab7ef2d0d3b9437095216b46081711f0949aa362dcab6489d6a6b2e8c80b89cd49c55a032dc036a1c
SSDEEP 384:5uAVllDAdCeCgeCC7iEcoYxQq1UTG/SoxoMCE1qK1o:UAydCeCgeCC71CkFE171o
TLSH
T1C892C5B52761846BDC4D0B36D4F917907970C123AE33D3890A9E60BD7A772A52E32EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UNETModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UNETModule.dll
Size 73KB
SHA256 4bd210faaa8c43f2586c9688a6adab7033abac316c21f27407370b20115f9252
MD5 3e2e197def4753f26aa8cbd9c52d8778
SHA1 83b40cbb15dd22cec7965bd8e38b46ab12ca805f
SHA512 cd613fe12844f5e66c17fec888d44771b47bdc96bfc5605949eb757744148a6427e02271b2f873258fcdfbfa5b2b1a88c084ccf538964bce1b30dce9d1595474
SSDEEP 1536:J0Tcx6EwAJ0A5VIkt5D8d+Eob4lm671O:J3xSAiIO+5D0+Db4lm6xO
TLSH
T12173F8699BED550FEAB91B79F8F4001007B5B4272612F34F47A8607D1DA73A09C32B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UnityAnalyticsModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UnityAnalyticsModule.dll
Size 13KB
SHA256 1bb7840d473d9e77bf527b9f447a929568e9d84b81d9029ed5702f8611bf2614
MD5 d5be0ef198ca503ec96ee770f68125e9
SHA1 5dcb0d7f1347f98fcb65e96d44fc7693b758f4a9
SHA512 79022704bdf85fe7ff43b9dc1d6c419e0499476c508ece3e86ad54f2af71e0045805a99e01c77b755869aea209dd75c2409b07104385bd48d2a57465fa06ecb0
SSDEEP 192:h4ZGll3Xkzk+UDBJZbpsfyVY9cYnNrJ6PwLmqM91LS:Y+0k+UHJ2QzYNV6PNqK1L
TLSH
T17952947567D491A7DD6D0F32D0B663407EB0C803DE32DB2A1BAD2074B97A1DC6E226B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UnityConnectModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UnityConnectModule.dll
Size 10KB
SHA256 faf2826324bf1831227fef362623d16e3f2bda4ff6ad127173c8eb7d847d8be1
MD5 a49f0fa108e53ac6728d1ec420aaa651
SHA1 d8c5cc1ffb2c8d452fd579ebc11f5a765265b598
SHA512 927eab1bdfa0482bf7aba36269c6a808ff379d8d2d841f306e6b7a80af09d3c4897b44b26c4afe44e4bbd7c5788b66e96628c3d6c98bad16a90c2fa54a9618e2
SSDEEP 192:KSjToKAdIKr0JoTqAT64qMMGgQqM91HS:RpAdlD9qFLQqK1H
TLSH
T1882241B4BBC0956BEC495F3794F683807BB0D412EF32D62A178E6074B5790CD6E719A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UnityWebRequestAudioModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UnityWebRequestAudioModule.dll
Size 8KB
SHA256 190eb84a30b531d2a285818afbef83ea7a9b47db5ae64b34c1791123ff05d9b8
MD5 2453714eae56a6b2e925896eed7f1894
SHA1 c02ff56041f41561d39b7a09a6cf081ea8af8148
SHA512 7ca501f4ad8648a9846220e77b5fe155b3ca56d2c09783d9eddae658e50bba572512440cc13f3da555505408de59a0c0000fc23d118839c4554045ab86d4b00d
SSDEEP 96:1s/aRWgO72QVc/Za8OlZA2hhW6L/GC7QbM91zd6x079:a/aRNQKFOlZA2bW6LPqM91V9
TLSH
T127F1FDB17AD21157EC164F72947993803AE0D423CF36C62A07DE61B9B8790DEBE20B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UnityWebRequestModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UnityWebRequestModule.dll
Size 34KB
SHA256 b49943944d3229cf1b686c2139e4745e2852b4c6da7d400e2cc2b80f2c141766
MD5 19767a74841fdebf5a3c110a5b8bce1c
SHA1 8f054176a47a8a9226a9bc9a0537004c3654368d
SHA512 434f9dd1b5510abd4c14bb99b63c039e1aa01485e23e513db0115dd124530ca8a5626d676e334baaa48bd7dd1afaf56ca6f57e83d55707c220c71c11c0b438e3
SSDEEP 768:C24uZ0DPtlANjcreqzER0XWDxKNBwAEgki78P1dviF713:C24uZ0sNArYR04KLw5gLAPTqF713
TLSH
T10CF23A2937E9D113FABE6BB594F041006B32F8176933DB5E0AAD127C1AB23D49D1076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UnityWebRequestTextureModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UnityWebRequestTextureModule.dll
Size 7KB
SHA256 60d2aa6a4a27f6bf2574b0a86cd759852575c08e8e92a0b29dc60509093cbf63
MD5 b6717ab9dd51c0bb2ef8ce3d922aea82
SHA1 476e99511855b8d56ca0bc7b58a311e2e7f9ad21
SHA512 e25af65ea93f32767cf15f32a004d00f4627c095b36f8907caeb5312d31202042727572f6cc9cd553cdb10d8210f4e2401e8a5bfe7bdc147e41e2ceb0e033c8d
SSDEEP 96:MbNS/CBgJimsZgKoc+3OMqXzu7QbM91PBGvV0hHC:MbrlmY+3OMUWqM91cQHC
TLSH
T1CEF10FB17AC551A7EC160F73843983C33AA0D423CE72C66A079E51B4F47A1DDBE21AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.UnityWebRequestWWWModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.UnityWebRequestWWWModule.dll
Size 18KB
SHA256 eebf5e8bc3112ad368a94da849e268b40047d05e090bcb878694064faa072ec3
MD5 c51fd7ba6e6b1602c40dae819096dfe5
SHA1 13a9e919f23df8c16e4b6e874e2a79372bba8bfd
SHA512 dba7ec9cfdf63ad3909371f74fcd1ab59505b68110992f7bca0bb051b00a68c64da153dee11bf71ed2d5f0c9efd8d637bdf48303c12dacdd711b3667ca1252ee
SSDEEP 384:vwhYlyrmWgyoONNRKDx0+gyC0GM7MqK1t+:w+8mWlo2uu+iwM71t+
TLSH
T1A382097766E49107EC5E2F7294B043803B71F4A26A32C35E1AAD20BDBD753686C71367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.VRModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.VRModule.dll
Size 24KB
SHA256 e467eb7b55300d421931d1c17f45e6c5f496466ba6438d681dc998a821fa6a04
MD5 537d89d962ff5da68a3f56843718919f
SHA1 59b1ebaeaf3f704717b761dc4f1630db703c2567
SHA512 86861bdc74f743fbf0fe508efa8f17ce515daad2f675cdeae8f8124e1b3205a1d30f6ab9d28f714f77e6ff95f8141d2be6b1b1e02e5c5bf827a79ffaf1e8cede
SSDEEP 384:Feeeeedc1WkqUZWVAQMYuamUJl73qH7XIsjIt0MZXg1j+hE74HFbhOj+qK1QH:Uc1WbUZ4xuamUJl73qH5Ijlb/71QH
TLSH
T105B2DAB023D1502BEC5B8B36B87453607A70F89BCA36C75712D81178787B59E6E62FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.VehiclesModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.VehiclesModule.dll
Size 10KB
SHA256 8266d455351ac0f6f2fa7feabf798b560e5c2a8979bcbd75ad31e4f71fd5d1b4
MD5 367188d6ebb67de0c666c374fdbb58cf
SHA1 479bae45e644517df8f93a60892ea7e8a9e18b88
SHA512 79a501425b9071e6f7d7058978ebf24d9a801393b29ebe74f383ef0f0eb651cfac11a68c04c5d34c72f6e2277921431b3ef22af66d1be5171830b9eedc8913ae
SSDEEP 96:A5jVMFdoC8edmYHE4PKf7uFWPzlq8vVQkNx7QbM913KcVRe0fI5:CjVMFdd8enEuaPzcknqM91aes
TLSH
T1302260B9F6D5549BEC5A9F32E434839039F4C112DF32D3190BAE50F4B87909DAE22A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.WebModule.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.WebModule.dll
Size 29KB
SHA256 60699e11f6e0a7ddc3bcdb5e32541d0b62e7e9dca5719893fcd5367267d37a9d
MD5 e6199cf3df76cc97528639bb0cd158f9
SHA1 b5baec07fe9c16a878a3112540f5abaf5c26d5be
SHA512 d53f42a14a4127c96bc40198d8c36b4d22e602b3cd0b5f1cf2c592b40ba0384cce46746ef26e72187e768447841697d9afa070ec43d0f547da589c18594de01e
SSDEEP 768:VkIfk+osSCm39sJ5MK6xTdbB4smXG71g:if/85MpxT74sEG71g
TLSH
T106D2082C7BD6D217C65CAB3650F243419634C48BE533EB260FD964B968732E81F922BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityEngine.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\UnityEngine.dll
Size 48KB
SHA256 97e0d30235f179cc5fefd4d3986a2e9f622853afb6304e10e494c682c81a9195
MD5 579edc5ddd00ddbad5141da9035b8bf7
SHA1 8ef872d7e5513d84f8bfc0c22455cf37e21a0bea
SHA512 4eeb36b5a98b9c46d6621ae7a4427759d9d8211ac013ef1a02ca5697cd605ac692dfacbe70291ce79857286fff00211e8f783037d66fe991c98a42d0482e571c
SSDEEP 1536:yEO4fneO8HM8P0NS7arihzzghSf5Cr+7t178nxZ+Q3r+N2cn:4hPvN2CW+BRRn
TLSH
T1D323F8B256865B33CCAF7F32DCAE96803BF0CCB6297ED86B201D524675AF6840716345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorlib.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Managed\mscorlib.dll
Size 2.4MB
SHA256 56f448fff0a2e14d5e63f60622b909a62e455a73c2bb38b7ea897f8947aa5fe3
MD5 ee65f60b23014d0a4565185e7f5a652a
SHA1 56c7651b9dd7bb835f2af97f7280c4deecb564d5
SHA512 328139be573e56af7856f3f16894215177894cf1dd5ea1b8dd48cce0fe525d1d7aca84cd027aeb473fe0196dc34937ccb5eb5c6c3920e51bbabb76d2cbf99de0
SSDEEP 24576:Epa2qN+0B0/QbghMjgF0UbdRuMQJW26XlaOwkXqURpZM/YO6QSMJ:EUxPB04bgZ0AlaOwkXqURpZMgO65
TLSH
T1D0C55C50ABF5CA2BE67A6775E8F101140BF4F852B763E34F364912B80CA33049D56B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mono.dll

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Mono\EmbedRuntime\mono.dll
Size 2.5MB
SHA256 7b5e4dbd908696ef39896502df14cb72963358288a926eb2401f487bc75de31a
MD5 694e91dbbdd75d52869cfcaaae6c473a
SHA1 b92390b2cd3353b54b7b01fbef70d1504f69ccfe
SHA512 0bb16b648ce163f45734ec4425cd85cadbf3df06353e3d8e4e8178b95e302560415492ed88a30792d121de2a26fa090d7dcd49e3863e76bba9eccdf84385c5b6
SSDEEP 49152:sqTUPHkzgWEXG8eIVn1MoDC2nTdEL8dpjVQVfZrTpEnx2RKDOkC:ZqHkzgWQRBndkZ02
TLSH
T161C57C8666508265C0AB403DC647460BD3B3B88AAF759B8B11E4BA9F5F73731164F33E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Mono\etc\mono\config
Size 1KB
SHA256 b585c70c70c88b3e03489361558f5d711c2ef71df9baaf37d92dbf95fbf6cd92
MD5 f95c345c1c53b820487f6b72e62d5485
SHA1 957e4e50e74c50347af92abf240c2c7aab3f3f79
SHA512 6b06434d07ee51be064a3efdca65b73e6c8e7560b43fb61633b08c7d2a0d792fe0670e57088c1dabd23929e0b7f7a27f65f503f2b640587042c8bbe98946368b
TLSH
T1FC318CDBE16C9DF9B071276592FEFBDC04B380A4CD1E31099E12DA411D25F9788439CA
MD5 SHA1 SHA512 TLSH

Submit Download

unity default resources

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\Resources\unity default resources
Size 3.4MB
SHA256 b809e16256c643c6ac8b5e6d0af164a9c9ec07e0e5bd49460939c39da5fafb40
MD5 cd647a9cd408c5ea5546260475811ed4
SHA1 dc89ac27e1ff6de7bed3da24fca94fba174f773d
SHA512 c373a1b2d6a70a3fdfd5aa9f0f944176e0357a5aebab705e1ee7c90c8baf3716c3c19af0f0904e9a1a7b9475859fbe2ceb3a6f0a4af85edab737a479a4d2a6b8
SSDEEP 6144:FBThzmCt9GPohSfZ2AOJeNosdzobL0vYSlPKyBL:FVhyDPohSBHDZov0QSt
TLSH
T1DDF54F253252D02EDC1A05358D73DEEE9276BDD8CEBA47133AD43F5FACB13489A21264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.info

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\app.info
Size 24B
SHA256 b9fdaeb78bf39f0e97f1c7943fad819c076df7123374ad94c98c19c9d099a018
MD5 828e91d28e418645aaf82c3aa01c08cb
SHA1 7b05806f4b22d2bfb9b88c25d29c54773fdadea0
SHA512 34304d0e1f78c046a2e2e54b96c95cb353dc00f3bced01e2714ea9b9b63235200e00b776eb286529ec74a20d7950e2767af0bc9a7b567b73e6febe2793220c70
MD5 SHA1 SHA512

Submit Download

globalgamemanagers

Path C:\Users\Admin\Downloads\Quicksand\quicksand_Data\globalgamemanagers
Size 34KB
SHA256 86caf537be1849ca71cfba7b80a45abc49c68020ef112eb7f1dc363187849bc9
MD5 288350feb36639aca7c8053bebcbf196
SHA1 e7c20f74f6cc7b314c2e5d37c8cff089a5ac3daa
SHA512 7ed4c2ce23f915f9c2d65a60dfa81bd19570b2b3c7ce1888c0cd261be00d153116931c284c42c32d4388a7cdbd32ac57032e9f499ea36300fe63acb1ae150475
SSDEEP 768:YjVoQX9eank5FY/IcOEfWmSRuvnYJNDwSa+wd:YjVoQX9eank5FY/IREumS8vMLa+
TLSH
T1B4F2D6698BB64C9AC893A7BB88C34F817A71FE994A53C3271374B8FC69FC6C55C00159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-383-0x0000017704A50000-0x000001770522A000-memory.dmp

Download

memory/424-384-0x0000017704A50000-0x000001770522A000-memory.dmp

Download