File name:

steamBox.exe

Full analysis: https://app.any.run/tasks/6e324755-6461-434a-ba30-d28e77118681
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 03, 2025, 11:52:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

2AB80973D9C8B540A6877B2321140FFB

SHA1:

6CCE50425E5B09BB21155EF477F948312CB5C92D

SHA256:

37C903910F91654C1A68751CD3B4DD6ADC1FDD3477BFB576081B2672BE39F3E9

SSDEEP:

24576:/RzXQRbCV6c1OtEhL2v0Bs/cBUWrBSy6ayO9SnGM8ujboDRLDFC4:/RzXQRGB1OtEhLLBs/cBUWrBSy6ayO0W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • steamBox.exe (PID: 4488)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • steamBox.exe (PID: 4488)

    • Reads the date of Windows installation

      • steamBox.exe (PID: 4488)

    • Reads security settings of Internet Explorer

      • steamBox.exe (PID: 4488)

    • Starts CMD.EXE for commands execution

      • steamBox.exe (PID: 4488)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3888)

    • Script adds exclusion path to Windows Defender

      • steamBox.exe (PID: 4488)

    • Starts POWERSHELL.EXE for commands execution

      • steamBox.exe (PID: 4488)

    • Executable content was dropped or overwritten

      • steamBox.exe (PID: 4488)

    • Potential Corporate Privacy Violation

      • steamBox.exe (PID: 4488)

    • There is functionality for taking screenshot (YARA)

      • steamBox.exe (PID: 4488)

  • INFO

    • The sample compiled with chinese language support

      • steamBox.exe (PID: 4488)

    • Checks proxy server information

      • steamBox.exe (PID: 4488)

    • Create files in a temporary directory

      • steamBox.exe (PID: 4488)

    • Reads the computer name

      • steamBox.exe (PID: 4488)

    • Process checks computer location settings

      • steamBox.exe (PID: 4488)

    • Checks supported languages

      • steamBox.exe (PID: 4488)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7796)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7568)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:11:06 13:21:14+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 730624
InitializedDataSize: 215040
UninitializedDataSize: -
EntryPoint: 0x818e4
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.7
ProductVersionNumber: 2.0.0.7
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: Hammer Tool
FileDescription: Hammer Tool
FileVersion: 2, 0, 0, 7
InternalName: steamBox.exe
LegalCopyright: Copyright (C) 2024
ProductName: Hammer Tool
ProductVersion: 2.0.0.7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start steambox.exe sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs backgroundtransferhost.exe no specs powershell.exe no specs conhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs shellexperiencehost.exe no specs steambox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\Users\admin\AppData\Local\Temp\steamBox.exe" C:\Users\admin\AppData\Local\Temp\steamBox.exe—explorer.exe
User:
admin
Company:
Hammer Tool
Integrity Level:
MEDIUM
Description:
Hammer Tool
Exit code:
3221226540
Version:
2, 0, 0, 7
Modules
Images
c:\users\admin\appdata\local\temp\steambox.exe
c:\windows\system32\ntdll.dll
960\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1532TASKKILL /F /IM "steam.exe"C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1532"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2908C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3888"C:\Windows\System32\cmd.exe" /c TASKKILL /F /IM "steam.exe"C:\Windows\System32\cmd.exe—steamBox.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4488"C:\Users\admin\AppData\Local\Temp\steamBox.exe" C:\Users\admin\AppData\Local\Temp\steamBox.exe
explorer.exe
User:
admin
Company:
Hammer Tool
Integrity Level:
HIGH
Description:
Hammer Tool
Exit code:
0
Version:
2, 0, 0, 7
Modules
Images
c:\users\admin\appdata\local\temp\steambox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7176"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7456"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
9 572
Read events
9 346
Write events
226
Delete events
0

Modification events

(PID) Process:(4488) steamBox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4488) steamBox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4488) steamBox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7456) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7456) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7456) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7176) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7176) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7796) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7796) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7796BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\39ecb02a-2877-4035-bbef-7573ec99ce92.down_data —
MD5:—
SHA256:—
7796BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:996DA96F7B324AF393887F84E28588CF
SHA256:1C50F1B776319E2A94A083CC14276F5E0BA1F37A8AB6E56A4CBD07D926E72F73
7796BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5f8770e5-2344-4afb-bf9d-b5e2dc10f7df.e68b8719-7820-47b6-a099-722472edaaa8.down_metabinary
MD5:6220DE562399F764ACF93DFC524E3B97
SHA256:79E0B05D2941CB0591955A81ECE1F8E1F383E060274D30D5964D771366634460
7796BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\39ecb02a-2877-4035-bbef-7573ec99ce92.e68b8719-7820-47b6-a099-722472edaaa8.down_metabinary
MD5:6220DE562399F764ACF93DFC524E3B97
SHA256:79E0B05D2941CB0591955A81ECE1F8E1F383E060274D30D5964D771366634460
4488steamBox.exeC:\hid.dllexecutable
MD5:F32D3902A69351D9D5899C8FB1D081A2
SHA256:EB4E7EA2AC57189F52720D7ED25773AA4D0FC894FCBEA173C13B7C2EB08D05D6
7568powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vq2jura0.rn2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7568powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dxiife3q.00o.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7796BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5f8770e5-2344-4afb-bf9d-b5e2dc10f7df.up_meta_securebinary
MD5:45CE9AAF8C10990B51EA67E256EF4B3F
SHA256:E6B8198FD76912F0E1F849A0387C6258530226B5913D2C89BE8ACD2FFC7066FA
4488steamBox.exeC:\Users\admin\AppData\Local\Steam\localData.vdfbinary
MD5:BE2C1809BCF620ACC01BD4322405E07F
SHA256:D354B145562F353F2ADDD340A1128B22087DD2DE2B9E126B1C14D4EDD0D4986B
7796BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:CEE22FAD3E72794D770B13641722076B
SHA256:9BD6568EFBC11CB92418DD5C9658DF893ACA27B276506E3599B7BEAD10CC36B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
20
DNS requests
14
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4488
steamBox.exe
POST
200
180.163.146.99:80
http://hammerbox.steam.work/api/GameBox/network
unknown
—
—
unknown
4488
steamBox.exe
POST
200
180.163.146.99:80
http://hammerbox.steam.work/api/GameBox/getVersion
unknown
—
—
unknown
4488
steamBox.exe
POST
200
180.163.146.99:80
http://hammerbox.steam.work/api/GameBox/boxDownFile
unknown
—
—
malicious
6652
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6652
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7796
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4488
steamBox.exe
POST
200
180.163.146.99:80
http://hammerbox.steam.work/api/GameBox/boxDownFile
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4488
steamBox.exe
180.163.146.99:80
hammerbox.steam.work
China Telecom Group
CN
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6480
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7796
BackgroundTransferHost.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7796
BackgroundTransferHost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6652
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
hammerbox.steam.work
  • 180.163.146.99
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.2
  • 20.190.159.129
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.23
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.145
  • 104.126.37.146
  • 104.126.37.160
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.171
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
4488
steamBox.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4488
steamBox.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4488
steamBox.exe
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
4488
steamBox.exe
A Network Trojan was detected
ET MALWARE Possible Windows executable sent when remote host claims to send html content
4488
steamBox.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
steamBox.exe