File name:

Steamtools.exe

Full analysis: https://app.any.run/tasks/fb70abc7-2f7f-4188-a992-471965e32bd7
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: June 20, 2025, 18:43:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
auto-reg
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

CC92BBD53F994BE0E2ACE95A293D8EE8

SHA1:

D5E13ADF53B4A3B2C2E256FD21277552D99BB113

SHA256:

4395E9912E2F56612CDCAE8B84A13FAB0BA0601470305A32A27894C6E20881EC

SSDEEP:

98304:be+Bv+MOKSv7kc83Og3RBhhfU6F/XhZsUKTeyf/g+Z59zrtbGD8rPHKf+jZMvcv3:O/VZrlqOnThzXuG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • winBit (32 bit).exe (PID: 6260)

    • Uses Task Scheduler to run other applications

      • winBit (32 bit).exe (PID: 6260)

    • Create files in the Startup directory

      • winBit (32 bit).exe (PID: 6260)

    • XWORM has been detected (YARA)

      • winBit (32 bit).exe (PID: 6260)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • st-setup-1.8.16.exe (PID: 2864)

    • Reads the date of Windows installation

      • Steamtools.exe (PID: 3752)
      • winBit (32 bit).exe (PID: 6260)

    • Reads security settings of Internet Explorer

      • Steamtools.exe (PID: 3752)
      • winBit (32 bit).exe (PID: 6260)

    • Executable content was dropped or overwritten

      • Steamtools.exe (PID: 3752)
      • winBit (32 bit).exe (PID: 6260)
      • st-setup-1.8.16.exe (PID: 2864)

    • The process drops C-runtime libraries

      • st-setup-1.8.16.exe (PID: 2864)

    • Uses ICACLS.EXE to modify access control lists

      • st-setup-1.8.16.exe (PID: 2864)

    • Creates a software uninstall entry

      • st-setup-1.8.16.exe (PID: 2864)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 5724)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 5724)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 4768)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2200)

    • The process executes via Task Scheduler

      • DiscordData (PID: 5184)
      • DiscordData (PID: 4040)

    • Connects to unusual port

      • winBit (32 bit).exe (PID: 6260)

    • There is functionality for taking screenshot (YARA)

      • SteamTools.exe (PID: 188)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • st-setup-1.8.16.exe (PID: 2864)

    • The process creates files with name similar to system file names

      • st-setup-1.8.16.exe (PID: 2864)

  • INFO

    • Checks supported languages

      • Steamtools.exe (PID: 3752)
      • st-setup-1.8.16.exe (PID: 2864)
      • winBit (32 bit).exe (PID: 6260)
      • SteamTools.exe (PID: 188)
      • DiscordData (PID: 6536)
      • DiscordData (PID: 5184)
      • DiscordData (PID: 4040)

    • Reads the machine GUID from the registry

      • Steamtools.exe (PID: 3752)
      • DiscordData (PID: 6536)
      • DiscordData (PID: 4040)
      • DiscordData (PID: 5184)
      • winBit (32 bit).exe (PID: 6260)

    • Reads the computer name

      • Steamtools.exe (PID: 3752)
      • winBit (32 bit).exe (PID: 6260)
      • SteamTools.exe (PID: 188)
      • DiscordData (PID: 6536)
      • DiscordData (PID: 5184)
      • DiscordData (PID: 4040)
      • st-setup-1.8.16.exe (PID: 2864)

    • Creates files in the program directory

      • st-setup-1.8.16.exe (PID: 2864)
      • Steamtools.exe (PID: 3752)

    • Process checks computer location settings

      • Steamtools.exe (PID: 3752)
      • winBit (32 bit).exe (PID: 6260)

    • Create files in a temporary directory

      • st-setup-1.8.16.exe (PID: 2864)

    • Creates files or folders in the user directory

      • winBit (32 bit).exe (PID: 6260)
      • st-setup-1.8.16.exe (PID: 2864)

    • Launching a file from a Registry key

      • winBit (32 bit).exe (PID: 6260)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5724)

    • Manual execution by a user

      • DiscordData (PID: 6536)

    • Checks proxy server information

      • SteamTools.exe (PID: 188)
      • slui.exe (PID: 4968)

    • Launching a file from the Startup directory

      • winBit (32 bit).exe (PID: 6260)

    • Reads the software policy settings

      • slui.exe (PID: 4968)

    • The sample compiled with english language support

      • st-setup-1.8.16.exe (PID: 2864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6260) winBit (32 bit).exe
C2127.0.0.1,2tuff-33336.portmap.io:9812
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
Mutext6Oq3DjQHYrWthox
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:20 16:57:15+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 8687616
InitializedDataSize: 69632
UninitializedDataSize: -
EntryPoint: 0x84aece
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Steamtools.exe
LegalCopyright:
OriginalFileName: Steamtools.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
20
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start steamtools.exe st-setup-1.8.16.exe no specs st-setup-1.8.16.exe #XWORM winbit (32 bit).exe icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs explorer.exe no specs explorer.exe no specs cmd.exe no specs conhost.exe no specs steamtools.exe discorddata no specs svchost.exe discorddata no specs slui.exe discorddata no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\SteamTools\SteamTools.exe" C:\Program Files\SteamTools\SteamTools.exe
cmd.exe
User:
admin
Company:
steamtools.net
Integrity Level:
MEDIUM
Description:
Steamtools
Version:
1.8.1.5
Modules
Images
c:\program files\steamtools\steamtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1520"C:\ProgramData\st-setup-1.8.16.exe" C:\ProgramData\st-setup-1.8.16.exe—Steamtools.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\programdata\st-setup-1.8.16.exe
c:\windows\system32\ntdll.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2864"C:\ProgramData\st-setup-1.8.16.exe" C:\ProgramData\st-setup-1.8.16.exe
Steamtools.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\st-setup-1.8.16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3460icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"C:\Windows\System32\icacls.exe—st-setup-1.8.16.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3752"C:\Users\admin\Desktop\Steamtools.exe" C:\Users\admin\Desktop\Steamtools.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\steamtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3980icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /TC:\Windows\System32\icacls.exe—st-setup-1.8.16.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4040"C:\Users\admin\AppData\Local\DiscordData"C:\Users\admin\AppData\Local\DiscordData—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\discorddata
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
6 755
Read events
6 743
Write events
12
Delete events
0

Modification events

(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:DisplayName
Value:
SteamTools
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:UninstallString
Value:
"C:\Program Files\SteamTools\Uninstall.exe"
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\SteamTools\Uninstall.exe" /S
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:InstallLocation
Value:
C:\Program Files\SteamTools
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:DisplayIcon
Value:
C:\Program Files\SteamTools\SteamTools.exe,0
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:NoModify
Value:
1
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:NoRepair
Value:
1
(PID) Process:(2864) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\SteamTools
Operation:writeName:Language
Value:
1033
(PID) Process:(6260) winBit (32 bit).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:DiscordData
Value:
C:\Users\admin\AppData\Local\DiscordData
(PID) Process:(188) SteamTools.exeKey:HKEY_CURRENT_USER\SOFTWARE\Valve\Steamtools
Operation:writeName:fScreenIndex
Value:
0
Executable files
20
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2864st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsi6F08.tmp\modern-wizard.bmpimage
MD5:3614A4BE6B610F1DAF6C801574F161FE
SHA256:16E0EDC9F47E6E95A9BCAD15ADBDC46BE774FBCD045DD526FC16FC38FDC8D49B
2864st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsi6F08.tmp\modern-header.bmpimage
MD5:F1928D020EBD3BF2C54FB46B3253F2A9
SHA256:A928EDA70352B4BF7FE85EBEE91B1CA819AD78A4DBA4547B95A1A3FFF51F89DD
2864st-setup-1.8.16.exeC:\Program Files\SteamTools\Core.dllexecutable
MD5:4BE563C65FF66351F94035D6B5624CC7
SHA256:C0EFDB388A3D1AAC1507B3DAABE63E7A3283AF81B1D1C04FDD1CA9F837882D51
3752Steamtools.exeC:\ProgramData\winBit (32 bit).exeexecutable
MD5:26AEDDE08CA160067F9DD5772861292A
SHA256:0877733111FFD9D627AB7A939E32976974C3FF1EB68E4A1755B57351D99C3975
3752Steamtools.exeC:\ProgramData\st-setup-1.8.16.exeexecutable
MD5:9C42F5CCAE30AFC9C70C924D543924F8
SHA256:80B6573208F2179C97CE64FF731269E349A07A3969C1198BF5A9092C5A01555C
2864st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Core.dllexecutable
MD5:817520432A42EFA345B2D97F5C24510E
SHA256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
2864st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Network.dllexecutable
MD5:3569693D5BAE82854DE1D88F86C33184
SHA256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
2864st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Gui.dllexecutable
MD5:47307A1E2E9987AB422F09771D590FF1
SHA256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
2864st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsi6F07.tmp —
MD5:—
SHA256:—
2864st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Widgets.dllexecutable
MD5:4CD1F8FDCD617932DB131C3688845EA8
SHA256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
53
DNS requests
23
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
POST
200
20.190.160.17:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
188
SteamTools.exe
GET
302
59.83.212.226:80
http://new-service.biliapi.net/picture/chatres/update/version2.txt
unknown
—
—
unknown
—
—
POST
200
20.190.160.132:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
188
SteamTools.exe
GET
200
8.133.135.83:80
http://stools.oss-cn-shanghai.aliyuncs.com/version2.txt
unknown
—
—
unknown
—
—
POST
200
20.190.160.132:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3964
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2288
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.17
  • 20.190.160.130
  • 20.190.160.20
  • 40.126.32.138
  • 20.190.160.4
  • 20.190.160.131
  • 20.190.160.66
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
steamtools.info
  • —
unknown
new-service.biliapi.net
  • 59.83.212.226
  • 122.188.45.51
  • 116.162.9.226
  • 119.167.249.58
  • 122.192.127.62
  • 122.188.44.51
  • 116.153.3.100
  • 122.188.45.182
  • 122.188.44.139
  • 122.189.171.103
unknown
stools.oss-cn-shanghai.aliyuncs.com
  • 8.133.135.83
unknown
2tuff-33336.portmap.io
  • 193.161.193.99
malicious

Threats

PID
Process
Class
Message
188
SteamTools.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2200
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
188
SteamTools.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2200
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2200
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
Process
Message
SteamTools.exe
"steamPath:"
SteamTools.exe
?????????????? "Host steamtools.info not found"
SteamTools.exe
?????????????? "Unknown error"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Steamtools.exe