File name:

SteamSetup.exe

Full analysis: https://app.any.run/tasks/388c5b4d-b69e-408c-8199-d187a3a6e9b9
Verdict: Malicious activity
Analysis date: April 29, 2025, 18:39:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

1B54B70BEEF8EB240DB31718E8F7EB5D

SHA1:

DA5995070737EC655824C92622333C489EB6BCE4

SHA256:

7D3654531C32D941B8CAE81C4137FC542172BFA9635F169CB392F245A0A12BCB

SSDEEP:

98304:S6RFwVoL8grR2bFl3BZmIsejD4m1DnSM3JeZ7FLoiPApPyDqwsd84+e0lLQbolhV:SAbrIo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SteamSetup.exe (PID: 7528)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SteamSetup.exe (PID: 7528)

    • The process creates files with name similar to system file names

      • SteamSetup.exe (PID: 7528)

    • Executable content was dropped or overwritten

      • SteamSetup.exe (PID: 7528)
      • SteamService.exe (PID: 7916)

    • There is functionality for taking screenshot (YARA)

      • SteamSetup.exe (PID: 7528)
      • Steam.exe (PID: 8116)
      • Steam.exe (PID: 516)

    • Creates a software uninstall entry

      • SteamSetup.exe (PID: 7528)

  • INFO

    • Checks supported languages

      • SteamSetup.exe (PID: 7528)
      • SteamService.exe (PID: 7916)
      • Steam.exe (PID: 8116)
      • Steam.exe (PID: 516)

    • Creates files in the program directory

      • SteamSetup.exe (PID: 7528)
      • SteamService.exe (PID: 7916)
      • Steam.exe (PID: 8116)
      • Steam.exe (PID: 516)

    • Create files in a temporary directory

      • SteamSetup.exe (PID: 7528)

    • The sample compiled with bulgarian language support

      • SteamSetup.exe (PID: 7528)

    • The sample compiled with english language support

      • SteamSetup.exe (PID: 7528)
      • SteamService.exe (PID: 7916)

    • Reads the computer name

      • SteamSetup.exe (PID: 7528)
      • SteamService.exe (PID: 7916)
      • Steam.exe (PID: 516)
      • Steam.exe (PID: 8116)

    • Manual execution by a user

      • Steam.exe (PID: 8116)
      • Steam.exe (PID: 516)

    • Reads the software policy settings

      • Steam.exe (PID: 8116)
      • slui.exe (PID: 6644)

    • Checks proxy server information

      • slui.exe (PID: 6644)
      • Steam.exe (PID: 8116)

    • Creates files or folders in the user directory

      • Steam.exe (PID: 8116)

    • Reads CPU info

      • Steam.exe (PID: 8116)
      • Steam.exe (PID: 516)

    • Reads the machine GUID from the registry

      • Steam.exe (PID: 8116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 00:55:51+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x33b6
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.10.91.91
ProductVersionNumber: 2.10.91.91
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Bulgarian
CharacterSet: Windows, Cyrillic
FileDescription: Steam
FileVersion: 2.10.91.91
LegalCopyright: © Valve Corporation
ProductName: Steam
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start steamsetup.exe sppextcomobj.exe no specs slui.exe no specs steamservice.exe conhost.exe no specs steam.exe slui.exe steam.exe no specs steamsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Program Files (x86)\Steam\Steam.exe" C:\Program Files (x86)\Steam\Steam.exe—explorer.exe
User:
admin
Company:
Valve Corporation
Integrity Level:
MEDIUM
Description:
Steam
Version:
08.90.88.32
Modules
Images
c:\program files (x86)\steam\steam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6644C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7432"C:\Users\admin\AppData\Local\Temp\SteamSetup.exe" C:\Users\admin\AppData\Local\Temp\SteamSetup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Steam
Exit code:
3221226540
Version:
2.10.91.91
Modules
Images
c:\users\admin\appdata\local\temp\steamsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7528"C:\Users\admin\AppData\Local\Temp\SteamSetup.exe" C:\Users\admin\AppData\Local\Temp\SteamSetup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Steam
Exit code:
0
Version:
2.10.91.91
Modules
Images
c:\users\admin\appdata\local\temp\steamsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7612C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7644"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7916"C:\Program Files (x86)\Steam\bin\steamservice.exe" /InstallC:\Program Files (x86)\Steam\bin\SteamService.exe
SteamSetup.exe
User:
admin
Company:
Valve Corporation
Integrity Level:
HIGH
Description:
Steam Client Service
Exit code:
0
Version:
08.90.88.32
Modules
Images
c:\program files (x86)\steam\bin\steamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7932\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SteamService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8116"C:\Program Files (x86)\Steam\steam.exe" C:\Program Files (x86)\Steam\Steam.exe
explorer.exe
User:
admin
Company:
Valve Corporation
Integrity Level:
MEDIUM
Description:
Steam
Exit code:
4294967294
Version:
08.90.88.32
Modules
Images
c:\program files (x86)\steam\steam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
4 606
Read events
4 572
Write events
32
Delete events
2

Modification events

(PID) Process:(7528) SteamSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Valve\Steam
Operation:writeName:Language
Value:
english
(PID) Process:(7528) SteamSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam
Operation:writeName:Language
Value:
english
(PID) Process:(7528) SteamSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Steam
Value:
"C:\Program Files (x86)\Steam\steam.exe" -silent
(PID) Process:(7528) SteamSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Valve\Steam
Operation:writeName:SteamInstaller
Value:
SteamSetup.exe
(PID) Process:(7916) SteamService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\SteamService
Operation:writeName:installpath_default
Value:
C:\Program Files (x86)\Steam
(PID) Process:(7916) SteamService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam
Operation:writeName:InstallPath
Value:
C:\Program Files (x86)\Steam
(PID) Process:(7528) SteamSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam
Operation:writeName:Publisher
Value:
Valve Corporation
(PID) Process:(7528) SteamSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam
Operation:writeName:URLInfoAbout
Value:
http://www.steampowered.com/
(PID) Process:(7528) SteamSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam
Operation:writeName:HelpLink
Value:
http://support.steampowered.com/
(PID) Process:(7528) SteamSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Steam\uninstall.exe
Executable files
9
Suspicious files
165
Text files
2 038
Unknown types
8

Dropped files

PID
Process
Filename
Type
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txttext
MD5:31A29061E51E245F74BB26D103C666AD
SHA256:56C8A86FA95EAB0D8F34F498E079B5516B96D2A2F1AD9C2A888555E50E47F192
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txttext
MD5:0340D1A0BBDB8F3017D2326F4E351E0A
SHA256:0FCD7AE491B467858F2A8745C5ECDD55451399778C2119517EE686D1F264B544
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_english.txttext
MD5:DA6CD2483AD8A21E8356E63D036DF55B
SHA256:EBECECD3F691AC20E5B73E5C81861A01531203DF3CF2BAA9E1B6D004733A42A6
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_czech.txttext
MD5:2158881817B9163BF0FD4724D549AED4
SHA256:650A265DFFDC5DC50200BB82D56F416A3A423EECC08C962CFD1BA2D40A1FF3F7
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txttext
MD5:9E62FC923C65BFC3F40AAF6EC4FD1010
SHA256:8FF0F3CBDF28102FF037B9CDA90590E4B66E1E654B90F9AEA2CD5364494D02B7
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txttext
MD5:18AAAF5FFCDD21B1B34291E812D83063
SHA256:1F45BB7BDFA01424F9237EEC60EBA35DC7F0DC4E8C2E193FE768FE96D3FF76D5
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_french.txttext
MD5:10C429EB58B4274AF6B6EF08F376D46C
SHA256:A1F6BA57EE41E009D904905C0CE5E75A59EE6790E08542561303109E1FAAFA13
7528SteamSetup.exeC:\Program Files (x86)\Steam\public\steambootstrapper_italian.txttext
MD5:8958371646901EAC40807EEB2F346382
SHA256:B01EC64D75FD1FBD00FBEB45A3FB39244911A8B22BB43DE4E0C03F205184F585
7528SteamSetup.exeC:\Users\admin\AppData\Local\Temp\nswD47A.tmp\modern-header.bmpimage
MD5:DA3486D12BB4C8AEC16BD9E0D363D23F
SHA256:D93B76D51BD2214FA6E999C1BF70B4AFF5165A6542F9B9B2A92B5672601F4624
7528SteamSetup.exeC:\Users\admin\AppData\Local\Temp\nswD47A.tmp\System.dllexecutable
MD5:A36FBE922FFAC9CD85A845D7A813F391
SHA256:FA367AE36BFBE7C989C24C7ABBB13482FC20BC35E7812DC377AA1C281EE14CC0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
29
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8116
Steam.exe
GET
200
2.18.161.41:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7320
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8116
Steam.exe
GET
200
23.53.40.144:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgTThpeLfRZ6t9vuAhJ8KHfVaw%3D%3D
unknown
—
—
whitelisted
7320
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 23.219.150.101
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.71
  • 40.126.31.0
  • 40.126.31.73
  • 20.190.159.129
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
cdn.steamstatic.com
  • 151.101.195.52
  • 151.101.3.52
  • 151.101.67.52
  • 151.101.131.52
whitelisted
x1.c.lencr.org
  • 2.18.161.41
whitelisted
r11.o.lencr.org
  • 23.53.40.144
  • 23.53.40.89
  • 23.53.40.138
  • 23.53.40.154
  • 23.53.40.131
  • 23.53.40.122
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SteamSetup.exe