File name:

bltools 2.8.3.exe

Full analysis: https://app.any.run/tasks/d9bb09b5-0e4c-447e-ac72-6956f1e59233
Verdict: Malicious activity
Analysis date: July 26, 2025, 10:14:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2EDC385B2BC4BA33D5C9E933DE824CD7

SHA1:

AACA225ECBC5621A61E5F4C14156C1D9F8650568

SHA256:

726D9F4F2413DB69C4D77839EF8B5BE95F88DDCB3331286ACA013A0EDFFC2CCE

SSDEEP:

98304:twWlOP19cTFbri4gbMkdLDvW2FMyJ8K7SWImz0J3p3SnALRGjfZbUlSdq2G0KB0Y:S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • bltools 2.8.3.exe (PID: 2680)
      • bltools.exe (PID: 2976)

  • SUSPICIOUS

    • Starts itself from another location

      • bltools 2.8.3.exe (PID: 2680)

    • Executable content was dropped or overwritten

      • bltools 2.8.3.exe (PID: 2680)

    • Connects to unusual port

      • bltools.exe (PID: 2976)

    • Checks for external IP

      • svchost.exe (PID: 2200)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2200)

    • There is functionality for taking screenshot (YARA)

      • bltools.exe (PID: 2976)

    • Found regular expressions for crypto-addresses (YARA)

      • bltools.exe (PID: 2976)

  • INFO

    • Checks supported languages

      • bltools 2.8.3.exe (PID: 2680)
      • bltools.exe (PID: 2976)

    • Creates files or folders in the user directory

      • bltools 2.8.3.exe (PID: 2680)

    • Reads the machine GUID from the registry

      • bltools 2.8.3.exe (PID: 2680)
      • bltools.exe (PID: 2976)

    • Reads Environment values

      • bltools 2.8.3.exe (PID: 2680)
      • bltools.exe (PID: 2976)

    • Reads the computer name

      • bltools 2.8.3.exe (PID: 2680)
      • bltools.exe (PID: 2976)

    • Launching a file from a Registry key

      • bltools 2.8.3.exe (PID: 2680)
      • bltools.exe (PID: 2976)

    • Creates files in the program directory

      • bltools.exe (PID: 2976)

    • Reads the software policy settings

      • bltools.exe (PID: 2976)

    • Checks proxy server information

      • bltools.exe (PID: 2976)

    • Disables trace logs

      • bltools.exe (PID: 2976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2084:08:07 13:25:20+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 2276864
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x22ddde
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.6.0
ProductVersionNumber: 1.6.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.6.6
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: -
ProductVersion: 1.6.6
AssemblyVersion: 1.6.6.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bltools 2.8.3.exe bltools.exe svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2632C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2680"C:\Users\admin\AppData\Local\Temp\bltools 2.8.3.exe" C:\Users\admin\AppData\Local\Temp\bltools 2.8.3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3
Version:
1.6.6
Modules
Images
c:\users\admin\appdata\local\temp\bltools 2.8.3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2976"C:\Users\admin\AppData\Roaming\BLTOOLss\bltools.exe"C:\Users\admin\AppData\Roaming\BLTOOLss\bltools.exe
bltools 2.8.3.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.6.6
Modules
Images
c:\users\admin\appdata\roaming\bltoolss\bltools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 385
Read events
5 369
Write events
16
Delete events
0

Modification events

(PID) Process:(2680) bltools 2.8.3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:service
Value:
"C:\Users\admin\AppData\Roaming\BLTOOLss\bltools.exe"
(PID) Process:(2976) bltools.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:service
Value:
"C:\Users\admin\AppData\Roaming\BLTOOLss\bltools.exe"
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2976) bltools.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bltools_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2680bltools 2.8.3.exeC:\Users\admin\AppData\Roaming\BLTOOLss\bltools.exeexecutable
MD5:2EDC385B2BC4BA33D5C9E933DE824CD7
SHA256:726D9F4F2413DB69C4D77839EF8B5BE95F88DDCB3331286ACA013A0EDFFC2CCE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
18
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6820
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3540
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6820
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.110.211:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3584
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2976
bltools.exe
193.161.193.99:32961
heheszon-32961.portmap.io
OOO Bitree Networks
RU
malicious
2976
bltools.exe
136.243.53.56:443
ipwho.is
Hetzner Online GmbH
DE
malicious
3540
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3540
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
heheszon-32961.portmap.io
  • 193.161.193.99
malicious
ipwho.is
  • 136.243.53.56
malicious
login.live.com
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.4
  • 40.126.32.134
  • 20.190.160.132
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 23.55.110.211
  • 23.55.110.193
whitelisted
www.microsoft.com
  • 23.3.109.244
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2200
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2200
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bltools 2.8.3.exe