stealc | hxxps://github[.]com/kjustin2222/VersionUnlimited/archive/refs/heads/main[.]zip

Analysis

max time kernel
599s
max time network
538s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kjustin2222/VersionUnlimited/archive/refs/heads/main.zip

Score

10^/10

stealc spyware stealer

Malware Config

Extracted

Family

stealc

http://reserchvpn.com/d9e6a8dee399ba79.php

Signatures

Detects Stealc stealer 6 IoCs

stealer

resource	yara_rule
behavioral1/memory/1884-580-0x00000000009E0000-0x0000000000C09000-memory.dmp	family_stealc
behavioral1/memory/3592-589-0x0000000000AC0000-0x0000000000C02000-memory.dmp	family_stealc
behavioral1/memory/1884-592-0x00000000009E0000-0x0000000000C09000-memory.dmp	family_stealc
behavioral1/memory/3588-922-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc
behavioral1/memory/4940-929-0x0000000000AC0000-0x0000000000C02000-memory.dmp	family_stealc
behavioral1/memory/3588-928-0x0000000000400000-0x0000000000629000-memory.dmp	family_stealc

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3592	Setup_64.exe
4940	Setup_64.exe

Loads dropped DLL 2 IoCs

pid	Process
1884	AppLaunch.exe
1884	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 1884	3592	Setup_64.exe	119
PID 4940 set thread context of 3588	4940	Setup_64.exe	139

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4760	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133335788137320551"	chrome.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
2224	chrome.exe
2224	chrome.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
1884	AppLaunch.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
5068	7zG.exe
3204	7zG.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe
2828	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2948	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1956	1372	chrome.exe	83
PID 1372 wrote to memory of 1956	1372	chrome.exe	83
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 4996	1372	chrome.exe	86
PID 1372 wrote to memory of 1516	1372	chrome.exe	90
PID 1372 wrote to memory of 1516	1372	chrome.exe	90
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87
PID 1372 wrote to memory of 3572	1372	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/kjustin2222/VersionUnlimited/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7b859758,0x7ffe7b859768,0x7ffe7b859778
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1892,i,10620441781468078552,15273872244475576105,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4248

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VersionUnlimited-main\" -spe -an -ai#7zMap11305:104:7zEvent23687
1⤵
- Suspicious use of FindShellTrayWindow
PID:5068

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\" -spe -an -ai#7zMap7857:136:7zEvent19144
1⤵
- Suspicious use of FindShellTrayWindow
PID:3204

C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe
"C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    PID:3904
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4760

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:1996

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2828

C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe
"C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Readme.txt

Filesize
185B

MD5
4ffa3d08df83f0720c03b05f0815347c

SHA1
8999ea77f71ca10a4b5e400fdc938b53f5fdf272

SHA256
8c9fe886b83786e6a460e977df20cae5b014afe9c99ae63280ee455086a97bb4

SHA512
9d5388b58b77136c0e00b214ac4b901dd90a3cb38fd0184073141b1e371696eb56cdb70cf3abc61f141034f8a54aaa28386bd604ad9ad210a3084727ec58ddc6

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
ebfb4ce732f0935631bec4458df41fc0

SHA1
108eb812c02fb1744fdaf5a28bd184283f798232

SHA256
e91c20943fc4df831817b1bf97773c585482a20290a025090ee4f98eb2306c29

SHA512
f2fae082bb0c58a3102b8338d39e603bc7e4ed17558f90af263b5e9a065f1d9e55cc37ea361548a092c350ec7978393ada100b0c212f925eaf7581e9f0d74895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
78244e1811c1738ffe97d285692a7381

SHA1
0ab04906e3df622f07ad7c782afd3fcdb5b034c4

SHA256
64e4abd0306627eb78e9b7796aa92d24cafe7b5415d83c640a0c0d59bf2fcf52

SHA512
d75b9a6d106a512fec3a174e493e5b9e4925c174560981b3151971880db53085ed559b34accf77432e6510a0f62c9d2f108e6dd22fe0a2a4cedbabe8e7b7e7e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
702B

MD5
f5fc6f9960096746f7fd29d0887c684f

SHA1
cd591f93e7006521f895bb8b62f2691c907b23d7

SHA256
4cf9b37d88bfe0a1c83a3cdd5bf0bb8c7691e9b2a36af352b9462fbaba02997f

SHA512
fd4b0c78a766bd455aeda017a2a4a5991896926bee2f65026d530639265bb91d4d5f80a67c8032caa100d7a08f0116bfd724a6fbcebc7d2415991c45897e651c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d6597e31df4f4666b56629a522bc7bba

SHA1
003305f476c950e3d3f6a2858177fa1166731568

SHA256
4905ee997da2f6f40eca9ab7668af2d31d7d74ab9410409d58c55660c614da86

SHA512
560e2d74a7a6e36963e296081a0eb02dde83ba4e27e42cc7ed3a0be775e41a8603bc6d0a690f2c4f2fc007cd76e437e91b771d5ddee27d806c1f3c346cb3153f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5e6e65671a82066e9288524a6b0a5c62

SHA1
99fc439d62652bd5ce030b7d85f3588b534478de

SHA256
45f02f429ffb05454a1680b8a702949ae52d92fd19acbde987ff70d981c3ce83

SHA512
a6232d2dd05adacd02f57dd7995a0f2e058ab95d04d4072809bae1a8cb0a6d18668eec844a846fe694dd80b2730ff542fc5ca2adc38e79e9e12d43907c910f81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
541c0a2aa9cd7f3120724bf4f4883435

SHA1
8c548f74788e335d6cca2277b4479ff33b9d54c1

SHA256
b076f905eba51aaaf5547d4970a9dd13256a380b4c2ed6b0c82e5ef8e06f6363

SHA512
74a5f314c1b2457db4130eda31a6f9b99f5a305a294a336cb564de52869e7bdb02f68a0bb641e1c39c931d432a43072234d85fd3974c9cd7ceefe38208f41d69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
541c0a2aa9cd7f3120724bf4f4883435

SHA1
8c548f74788e335d6cca2277b4479ff33b9d54c1

SHA256
b076f905eba51aaaf5547d4970a9dd13256a380b4c2ed6b0c82e5ef8e06f6363

SHA512
74a5f314c1b2457db4130eda31a6f9b99f5a305a294a336cb564de52869e7bdb02f68a0bb641e1c39c931d432a43072234d85fd3974c9cd7ceefe38208f41d69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
106KB

MD5
43d46c29c724dced8439a20aca0db55c

SHA1
71f34e3b3f47ed838418392e1c8820b7708f642a

SHA256
5ed19bd677a2d65f467e0899a6a882742170751fc2237da093537bc066467bd6

SHA512
430b679802371ca17d2b15bafb3617fbad65930b8d31426612b1c359bbd60ade62a10a4fce70f4e9ed35b55db9810e06c5e39270dc970d563bd160f56e1311dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f230.TMP

Filesize
103KB

MD5
7a749b9253c772d77d0422d1954f5541

SHA1
f219e02ae5a69a994a87ef3569492295d1c79573

SHA256
15b2f9d1fa337fa15cc21b7c764d0409090f8d15dcfb8ca1bc47c4568180cdbb

SHA512
29aaee8b7923d034ef490d938cbafe202ce7f430f377980f2ffbf1c87dddb0dcefa1dad24e2a3179729e9241ce7be910e977075fb9a461beacb00f4a1ab61789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}

Filesize
36KB

MD5
8aaad0f4eb7d3c65f81c6e6b496ba889

SHA1
231237a501b9433c292991e4ec200b25c1589050

SHA256
813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

SHA512
1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe

Filesize
36KB

MD5
406347732c383e23c3b1af590a47bccd

SHA1
fae764f62a396f2503dd81eefd3c7f06a5fb8e5f

SHA256
e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e

SHA512
18905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main.zip

Filesize
3.6MB

MD5
88ca4f43b89112d94a4d6a9fce6c323b

SHA1
5d9ab7ad336397d460d78430f09a6584f1ed1f23

SHA256
1f10e465c318a17268f3edd3e2c8abbf7f5bccd3b87cb9e83eec5dc6a1fd0c33

SHA512
70b0eedf5d66fc93f68b88c0b6fee0d84957703dc5c235855c21a4cefcdce467c463c4664e4e0fba17b012e18f46ed326bd6a681fcd05a12275ac8cdc6c431b9

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main.zip

Filesize
3.6MB

MD5
88ca4f43b89112d94a4d6a9fce6c323b

SHA1
5d9ab7ad336397d460d78430f09a6584f1ed1f23

SHA256
1f10e465c318a17268f3edd3e2c8abbf7f5bccd3b87cb9e83eec5dc6a1fd0c33

SHA512
70b0eedf5d66fc93f68b88c0b6fee0d84957703dc5c235855c21a4cefcdce467c463c4664e4e0fba17b012e18f46ed326bd6a681fcd05a12275ac8cdc6c431b9

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim.zip

Filesize
3.7MB

MD5
63cc794ca2493cbb400de305893e72e7

SHA1
8284fd9ee7ee832181e264b137b3ab3017c4209c

SHA256
fd37517f1884829ae2d0721e288ba223d35822706481a2fb2dc695167e7c190f

SHA512
2f1d2d8a440c2b7d47c08b5a88e88841c3efa7610b1e0cbd1b91229195abb9e7af1b1c00f2ef58838f467fafbc433efd8806c8f73ea82d124162c9604254f9c0

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe

Filesize
687.6MB

MD5
8dca0c1b5626872ee96b24114d6ab244

SHA1
6ae4e42b52f4da66404735f57d1f53c0f32fe8f4

SHA256
eedb74f53e38ee008977fc458bd4102073b2031e78c68c8ecae1b5759b6ae189

SHA512
e1443f2edef6c3ea18f7b0cd652811b0add2b9409f15713c26a9935629e987902d87e867f54c7eb95d27cc1c41a67e592edad8f68293d930c1520191b0c7ff47

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe

Filesize
687.6MB

MD5
8dca0c1b5626872ee96b24114d6ab244

SHA1
6ae4e42b52f4da66404735f57d1f53c0f32fe8f4

SHA256
eedb74f53e38ee008977fc458bd4102073b2031e78c68c8ecae1b5759b6ae189

SHA512
e1443f2edef6c3ea18f7b0cd652811b0add2b9409f15713c26a9935629e987902d87e867f54c7eb95d27cc1c41a67e592edad8f68293d930c1520191b0c7ff47

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main\NewVersionUnlim\Setup_64.exe

Filesize
687.6MB

MD5
8dca0c1b5626872ee96b24114d6ab244

SHA1
6ae4e42b52f4da66404735f57d1f53c0f32fe8f4

SHA256
eedb74f53e38ee008977fc458bd4102073b2031e78c68c8ecae1b5759b6ae189

SHA512
e1443f2edef6c3ea18f7b0cd652811b0add2b9409f15713c26a9935629e987902d87e867f54c7eb95d27cc1c41a67e592edad8f68293d930c1520191b0c7ff47

Download Submit
C:\Users\Admin\Downloads\VersionUnlimited-main\Readme.txt

Filesize
185B

MD5
4ffa3d08df83f0720c03b05f0815347c

SHA1
8999ea77f71ca10a4b5e400fdc938b53f5fdf272

SHA256
8c9fe886b83786e6a460e977df20cae5b014afe9c99ae63280ee455086a97bb4

SHA512
9d5388b58b77136c0e00b214ac4b901dd90a3cb38fd0184073141b1e371696eb56cdb70cf3abc61f141034f8a54aaa28386bd604ad9ad210a3084727ec58ddc6

Download Submit
memory/1884-592-0x00000000009E0000-0x0000000000C09000-memory.dmp

Filesize
2.2MB

Download
memory/1884-580-0x00000000009E0000-0x0000000000C09000-memory.dmp

Filesize
2.2MB

Download
memory/1884-593-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2828-907-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-915-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-919-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-918-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-917-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-908-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-909-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-913-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-914-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2828-916-0x000002A51B2F0000-0x000002A51B2F1000-memory.dmp

Filesize
4KB

Download
memory/2948-705-0x000002DE6B400000-0x000002DE6B420000-memory.dmp

Filesize
128KB

Download
memory/2948-701-0x000002DE6B020000-0x000002DE6B040000-memory.dmp

Filesize
128KB

Download
memory/2948-703-0x000002DE6ADE0000-0x000002DE6AE00000-memory.dmp

Filesize
128KB

Download
memory/3588-922-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3588-928-0x0000000000400000-0x0000000000629000-memory.dmp

Filesize
2.2MB

Download
memory/3592-579-0x0000000000AC0000-0x0000000000C02000-memory.dmp

Filesize
1.3MB

Download
memory/3592-589-0x0000000000AC0000-0x0000000000C02000-memory.dmp

Filesize
1.3MB

Download
memory/4940-921-0x0000000000AC0000-0x0000000000C02000-memory.dmp

Filesize
1.3MB

Download
memory/4940-929-0x0000000000AC0000-0x0000000000C02000-memory.dmp

Filesize
1.3MB

Download