blackguard | hxxps://www[.]mediafire[.]com/file/u6hk35tcu441lxk/Bltools+2[.]9[.]1[PRO][.]zip/file

Analysis

max time kernel
105s
max time network
98s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-07-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/u6hk35tcu441lxk/Bltools+2.9.1[PRO].zip/file

Score

10^/10

blackguard credential_access discovery spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 3 IoCs

pid	Process
1312	Bltools 2.9.1[PRO].exe
1000	Settings.exe
2644	XConfig.setup.exe

Loads dropped DLL 10 IoCs

pid	Process
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe
2644	XConfig.setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
160	api.ipify.org
161	api.ipify.org
162	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2644	XConfig.setup.exe
2644	XConfig.setup.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3829149121\2365354878.pri	PickerHost.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Settings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XConfig.setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Settings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Settings.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.mediafire.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "124"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "51"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	PickerHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	PickerHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	PickerHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	PickerHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	PickerHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	PickerHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\mediafire.com\NumberOfSub = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "428076879"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	PickerHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = c0321879cadeda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.mediafire.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\mediafire.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	PickerHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 78c4cb1398deda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	PickerHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	PickerHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000523c4119ccb15ebd44fdab04af168399b2d6b049a0723ea0e10ac10d27fe663e5af0db9ab7b5786caa911fecba3e010570078ebb5e56fe719b11	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "751"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 62eaf11398deda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b57ab81398deda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	PickerHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\Bltools 2.9.1[PRO].zip.k6y6bg2.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1000	Settings.exe
1000	Settings.exe
1000	Settings.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1580	MicrosoftEdgeCP.exe
1580	MicrosoftEdgeCP.exe
1580	MicrosoftEdgeCP.exe
1580	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2388	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2388	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2388	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	908	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	908	MicrosoftEdgeCP.exe
Token: SeRestorePrivilege	972	7zG.exe
Token: 35	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeDebugPrivilege	1000	Settings.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
972	7zG.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
532	MicrosoftEdge.exe
1580	MicrosoftEdgeCP.exe
2388	MicrosoftEdgeCP.exe
1580	MicrosoftEdgeCP.exe
2092	PickerHost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1580 wrote to memory of 4920	1580	MicrosoftEdgeCP.exe	77
PID 1312 wrote to memory of 1000	1312	Bltools 2.9.1[PRO].exe	88
PID 1312 wrote to memory of 1000	1312	Bltools 2.9.1[PRO].exe	88
PID 1312 wrote to memory of 1000	1312	Bltools 2.9.1[PRO].exe	88
PID 1312 wrote to memory of 2644	1312	Bltools 2.9.1[PRO].exe	89
PID 1312 wrote to memory of 2644	1312	Bltools 2.9.1[PRO].exe	89
PID 1312 wrote to memory of 2644	1312	Bltools 2.9.1[PRO].exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.mediafire.com/file/u6hk35tcu441lxk/Bltools+2.9.1[PRO].zip/file"
1⤵
PID:2856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:532

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:3604

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2092

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\" -spe -an -ai#7zMap28288:94:7zEvent27893
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1924

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1[PRO].exe
"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1[PRO].exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe
  "C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe
  "C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2644

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\outlook.com\EmailPass.txt
1⤵
PID:5424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\U2RU9O92\www.mediafire[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\U2RU9O92\www.mediafire[1].xml

Filesize
1KB

MD5
bd915429730f45fdb2d171ae4db169b5

SHA1
12c6f93a3f8708cfda06c025b0c5e3c9041c3b81

SHA256
77e8f8ea8f18c1de59ca32be0053d3831d3549c6d2010d879c6069bf199e245b

SHA512
6c36c79aa634eda08ad3082510a641bb25656f153a2881eb2d896aec2b8c20c6a746f4a01c810d3b659cae228689e9b8944ff9bb51b532a6e53b015017ad055a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\57QJXHSK\favicon[1].ico

Filesize
10KB

MD5
a301c91c118c9e041739ad0c85dfe8c5

SHA1
039962373b35960ef2bb5fbbe3856c0859306bf7

SHA256
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

SHA512
3a5a2801e0556c96574d8ab5782fc5eab0be2af7003162da819ac99e0737c8876c0db7b42bb7c149c4f4d9cfe61d2878ff1945017708f5f7254071f342a6880a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TVIVSQH5\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WC8C72FW\Bltools 2.9.1[PRO][1].zip

Filesize
192KB

MD5
835218fe5b9a42c8ec98442dc44f8551

SHA1
b8f5f190d1bcd9fb7b804a78419703298d9af1d8

SHA256
19c8fb2838081c42f602f655b288c3339fad55acd2f5cbcc07e08ab3496d92e8

SHA512
d37f24aa9c53044f52a43bc8c50cedd2c1d446280aa4401d00dcd3429bec4647d4f7f2183c625ebbc6fc083b10c5f0d4d32549c25f790d9cca3e064918115749

Download Submit
C:\Users\Admin\AppData\Local\WindowsBrandOr\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\WindowsBrandOr\Process.txt

Filesize
1KB

MD5
4177e61164e6e93cfaed9d7b339b4359

SHA1
156e40f5f3755cfbdc8bed816e8a3da0ae729e82

SHA256
5f16cad5faf0af5b14bfa5f1f19b28b18b13f8fd57f63d055cb87c2dca992776

SHA512
da56ba1eaf1cf8407c184193404d7588bc3354762ebf2665e32a642af3329a8aa2779bebe40e87af44024669b2e7d0cfc7ce2eba7f020f3e9f034153550937e9

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO].zip.k6y6bg2.partial

Filesize
13.5MB

MD5
118b54c5fea1876411dbab7d8aee546f

SHA1
1a421aefdb70267bb244d6b8f466b032937062cc

SHA256
ad618514efb30fe0bf4eed2949b5d9458105ae11c60de5e802505af7256e5ca4

SHA512
fc1977df3817a0c708d3667d80e425f42a03da769822dcd95cca0e32984728640a25056a110d63048b17f776c639c7649db5b194a2b71efe120b168f881071ea

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1[PRO].exe

Filesize
3.5MB

MD5
78476189d432ff40798e50580486263f

SHA1
fa3f47fb8306f63315e7af91e8b9ff1ac194a2f2

SHA256
71e58a3b9932ab8ec42749ffa00ab1b81c0b9f1854112373a889dc71ec50f9bc

SHA512
4226c818aa8edadf8e3500b86701d1caec30966ad61e750d433d8f53a5ec440eff73a3c31547448b6b36ec8a1f700a260efc2631263553451f8921bcca48105f

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\MaterialDesignThemes.Wpf.dll

Filesize
9.1MB

MD5
824cbf63999f954aa1747f79586a4d3c

SHA1
5f1cd6346a45024bbbe09e304c12b6f6bf227d5c

SHA256
344e2cee979e979932f504dc76bd75e97ae1ff46caa3fe2795adfe0a866347f7

SHA512
d36149f7cb5ffc62dac6bb4521105d09fac988de567e181fdca4f23e5079aca5f4292e1d314f797f1a597263ddac0210060cb71c111565717e3a288a47770c51

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.INI

Filesize
3KB

MD5
d9698097b7dc813f66fdd09347146178

SHA1
8e3f9836ac2bf661a77e4a984dfcdfcd2202e610

SHA256
ed947ae727143a9629315eea856776bac664333d242bd5752c75a46cb5540bef

SHA512
a022994eb86aff8209563da4d6fc615787ff5fff03bac3084b4343726bea740376d1224cf0707d5b0673990ef14a908895199ab48fda87bf5b543f1f62587527

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe

Filesize
293KB

MD5
ddb3bc4925f6f2067b1794390bd8f1f7

SHA1
0d807445e9f16a8d3736f7bc85cd073f811fd3b7

SHA256
a28aa05fa3569bdbea78d80d5cf86243adb518f40f395dbd3a7609ac2b14aca9

SHA512
dedd801f98fad6b3a1798676b04e95f7bb39b584373c4e6542923707c3532ffac627da6d71ac3066c88097faa18cde5399f62de419855aea85e600d83e1f158b

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe

Filesize
3.2MB

MD5
025d637741b1b326ded2e99e6b54ed77

SHA1
5fb6a288559f54aeb42203cf5e44a072c74f942f

SHA256
d68b3cdca20f0b871a653a3203e4292846e766b45fb989856a2de0fb9e0c4860

SHA512
720f4f03febbe7fdd661c14349680f6511a69487b0bdf5cd47ab4594b1fad49edeb0bde8e287272d84e21efc916ba91ca71bfa2632eba76e379e07815163d26b

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\hotmail.com\All_EmailPass.txt

Filesize
1.2MB

MD5
5cfc26570fe8fc7ea5db16484a39d0f5

SHA1
19ef3f0d4d907cfcf1e5af9a2640f5519a426734

SHA256
c042a41ae731f0d31ddff855e212a258ddd54c8102a3103313d298e5fb5176ab

SHA512
b34d4533c89409739850d415d4aa6a6067f8bf785c8e6bc1b23a432e88e90da38bdc9716198c21609a87c2788777baabf16307c17f0d71c01362bbc37dd12160

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\hotmail.com\All_LoginPass.txt

Filesize
738KB

MD5
571be74355d0be4a9e3049e71e061831

SHA1
2852d60a573c8c2b113b4a05f79ba1dba2c1c576

SHA256
55d19a2e37a277012be055baba74b187912cedb0886892b9582c59cecbbe7ea0

SHA512
952a1efdb3e7f5321c35e80d9f3c06acf49f529860a035fee5bb6b5644d2ad3330ea00a9d6b550444691462c04b3636c4aa12ce802c3b75723942a4434b53833

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\outlook.com\All_EmailPass.txt

Filesize
1.2MB

MD5
94de6c34c4a6ed0841b135b45b1065c4

SHA1
ad01f05d00981e2231c73d673a26085e62517459

SHA256
79611002cfdd4256606e79ad570452fa1b478deb54b0eca28c709ac2d70fbcac

SHA512
4a2dc73235c4b9acfa6513fe94b2ff4bf2cde6c0f8e73af8845ace414cc35c018e89137c41d8528af875c5e23fb10c8c11ffec98dbfa03a2e9d609e7a9d87413

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\outlook.com\All_LoginPass.txt

Filesize
738KB

MD5
1f3d30fb20a3c881b5662acb16994696

SHA1
a4d37f2eba7d907682844abb2311968a782a6390

SHA256
3d9a1426c934b9c48a7abd6be73a9981fdd764e4193cc73d7482d320b638b1e4

SHA512
4f69833835d394d7bc3277242ee89203e98d09c2f95e7913271a004dce4295c0ad4de48e50fe6c7efa9a4af210b7994152511b7c79348fe630723032653b4fad

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\outlook.com\EmailPass.txt

Filesize
68B

MD5
a76cc7a95ced7b01b023960cd0d62bc7

SHA1
97d445d2743b93810a7133c51c563be6ca3602b4

SHA256
6f206cdda0fdd59094ccfb1b1ac4781cea64f900f36bd98198f3e6d444024682

SHA512
5db78cffcf87016f7de090314aca66f7bcb86b58c03661cb613f056cf70c99ae5278a4acaf1b9987cdc230df30403b1dce7744735dd73cc575ecd16ff63a906e

Download Submit
C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\[Results] Password Searcher\[12.07.2024] [07.22.07] ⚡️Luffich&Cloud FREE LOGS [1138]⚡️\outlook.com\UrlLoginPass.txt

Filesize
89B

MD5
8e6a0e63223071e66caaf987831e6d25

SHA1
1ef6a1da48e55d4298098cef20c67c893ec5e96e

SHA256
131e69f6cc64d3cad7027e4d071a726a8c76460033692236016cffb5cca806a2

SHA512
5c80177a7f395b40c16c9fc5e2383532ee9f6286af39ab05fe119d259d9aa8475d63449b0d6b902884c7cdc85cbeb482bce21068b7b7311cee864d1dfc9968c6

Download Submit
\Users\Admin\Desktop\Bltools 2.9.1[PRO]\AlphaFS.dll

Filesize
359KB

MD5
f2f6f6798d306d6d7df4267434b5c5f9

SHA1
23be62c4f33fc89563defa20e43453b7cdfc9d28

SHA256
837f2ceab6bbd9bc4bf076f1cb90b3158191888c3055dd2b78a1e23f1c3aafdd

SHA512
1f0c52e1d6e27382599c91ebd5e58df387c6f759d755533e36688b402417101c0eb1d6812e523d23048e0d03548fd0985a3fd7f96c66625c6299b1537c872211

Download Submit
\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Extreme.Net.dll

Filesize
121KB

MD5
f79f0e3a0361cac000e2d3553753cd68

SHA1
4314bcef76fddc9379a8f3a266b37d685d0adb79

SHA256
8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd

SHA512
c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355

Download Submit
\Users\Admin\Desktop\Bltools 2.9.1[PRO]\MaterialDesignColors.dll

Filesize
295KB

MD5
5c108c4da6d03f0fa2c3b4dc7890cb52

SHA1
48af67b6166068b6f138306bbd1157c7583c6e73

SHA256
b5ec30c93b1d2b4631ee2b178750ec92e302e2e331090ec9783981b9572354f8

SHA512
48d055610eead361809bd839c66ccdca1d5e0d9dffe15af9d15afa106ee7791c8b17acb91f2aba5cf3dda2997b049bcf70b43c3b56b8b01f1fc7bb845ce6c91b

Download Submit
\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Ookii.Dialogs.Wpf.dll

Filesize
103KB

MD5
932ebb3f9e7113071c6a17818342b7cc

SHA1
9ce2d08bc3840632092325abcc8d842eeb8189d4

SHA256
285aa8225732ddbcf211b1158bd6cff8bf3acbeeab69617f4be85862b7105ab5

SHA512
6b6086cff7b916c0c4536e3c7cba4ba17d6c4be2e4a88a5877be852e197f1f9c9c120d1295acf2b4277a9badd8cfd229ef3c1ab2049d0aeec22d3033be156141

Download Submit
memory/532-192-0x00000236FC2E0000-0x00000236FC2E1000-memory.dmp

Filesize
4KB

Download
memory/532-16-0x00000236F5E20000-0x00000236F5E30000-memory.dmp

Filesize
64KB

Download
memory/532-0-0x00000236F5D20000-0x00000236F5D30000-memory.dmp

Filesize
64KB

Download
memory/532-35-0x00000236F31B0000-0x00000236F31B2000-memory.dmp

Filesize
8KB

Download
memory/532-193-0x00000236FC2F0000-0x00000236FC2F1000-memory.dmp

Filesize
4KB

Download
memory/1000-1278-0x0000000006E30000-0x0000000006E42000-memory.dmp

Filesize
72KB

Download
memory/1000-1268-0x0000000006E60000-0x0000000006EC6000-memory.dmp

Filesize
408KB

Download
memory/1000-1145-0x0000000006940000-0x00000000069D2000-memory.dmp

Filesize
584KB

Download
memory/1000-1116-0x0000000006530000-0x000000000654E000-memory.dmp

Filesize
120KB

Download
memory/1000-1115-0x0000000006590000-0x0000000006606000-memory.dmp

Filesize
472KB

Download
memory/1000-1114-0x00000000064C0000-0x0000000006510000-memory.dmp

Filesize
320KB

Download
memory/1000-1111-0x0000000000E20000-0x0000000000E70000-memory.dmp

Filesize
320KB

Download
memory/2388-43-0x000001C841140000-0x000001C841240000-memory.dmp

Filesize
1024KB

Download
memory/2644-1131-0x0000000006290000-0x0000000006BBC000-memory.dmp

Filesize
9.2MB

Download
memory/2644-1139-0x0000000005A60000-0x0000000005AC0000-memory.dmp

Filesize
384KB

Download
memory/2644-1310-0x0000000007660000-0x000000000766A000-memory.dmp

Filesize
40KB

Download
memory/2644-1309-0x0000000007640000-0x000000000764E000-memory.dmp

Filesize
56KB

Download
memory/2644-1292-0x00000000076C0000-0x00000000076C8000-memory.dmp

Filesize
32KB

Download
memory/2644-1291-0x0000000008C70000-0x0000000008C82000-memory.dmp

Filesize
72KB

Download
memory/2644-1113-0x0000000000530000-0x0000000000C80000-memory.dmp

Filesize
7.3MB

Download
memory/2644-1272-0x0000000008EC0000-0x0000000008EF8000-memory.dmp

Filesize
224KB

Download
memory/2644-1269-0x00000000061B0000-0x0000000006268000-memory.dmp

Filesize
736KB

Download
memory/2644-1146-0x0000000005C00000-0x0000000005D42000-memory.dmp

Filesize
1.3MB

Download
memory/2644-1127-0x00000000057F0000-0x0000000005814000-memory.dmp

Filesize
144KB

Download
memory/2644-1144-0x0000000006BC0000-0x00000000070BE000-memory.dmp

Filesize
5.0MB

Download
memory/2644-1143-0x0000000005980000-0x00000000059A0000-memory.dmp

Filesize
128KB

Download
memory/2644-1135-0x00000000059B0000-0x0000000005A00000-memory.dmp

Filesize
320KB

Download
memory/4920-111-0x0000023D3E660000-0x0000023D3E662000-memory.dmp

Filesize
8KB

Download
memory/4920-69-0x0000023D3CA10000-0x0000023D3CA12000-memory.dmp

Filesize
8KB

Download
memory/4920-109-0x0000023D3E620000-0x0000023D3E622000-memory.dmp

Filesize
8KB

Download
memory/4920-106-0x0000023D3E600000-0x0000023D3E602000-memory.dmp

Filesize
8KB

Download
memory/4920-103-0x0000023D3E4E0000-0x0000023D3E4E2000-memory.dmp

Filesize
8KB

Download
memory/4920-224-0x0000023D2C200000-0x0000023D2C300000-memory.dmp

Filesize
1024KB

Download
memory/4920-101-0x0000023D3E4D0000-0x0000023D3E4D2000-memory.dmp

Filesize
8KB

Download
memory/4920-438-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-441-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-113-0x0000023D3E680000-0x0000023D3E682000-memory.dmp

Filesize
8KB

Download
memory/4920-115-0x0000023D3E690000-0x0000023D3E692000-memory.dmp

Filesize
8KB

Download
memory/4920-117-0x0000023D3E6B0000-0x0000023D3E6B2000-memory.dmp

Filesize
8KB

Download
memory/4920-67-0x0000023D3C850000-0x0000023D3C852000-memory.dmp

Filesize
8KB

Download
memory/4920-433-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-64-0x0000023D3C820000-0x0000023D3C822000-memory.dmp

Filesize
8KB

Download
memory/4920-440-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-437-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-436-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-439-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-380-0x0000023D3C8D0000-0x0000023D3C8D2000-memory.dmp

Filesize
8KB

Download
memory/4920-435-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download
memory/4920-340-0x000002352A900000-0x000002352AA00000-memory.dmp

Filesize
1024KB

Download
memory/4920-99-0x0000023D3E4B0000-0x0000023D3E4B2000-memory.dmp

Filesize
8KB

Download
memory/4920-120-0x0000023D3E260000-0x0000023D3E280000-memory.dmp

Filesize
128KB

Download
memory/4920-270-0x0000023D41A40000-0x0000023D41A60000-memory.dmp

Filesize
128KB

Download
memory/4920-434-0x0000023D3C830000-0x0000023D3C840000-memory.dmp

Filesize
64KB

Download