URL:

https://cdn.akamai.steamstatic.com/client/installer/SteamSetup.exe

Full analysis: https://app.any.run/tasks/20ca1c04-c04f-4d76-b441-e65dab10a33a
Verdict: Malicious activity
Analysis date: February 05, 2024, 18:33:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

506D24DCD6153BD4FE5F6C484AD7B3B3

SHA1:

9BA5F8DFBFABD97DA4562C9E0DA13EE3711BCEBD

SHA256:

C0A0848B287B2767D26192A7459FC3D51D81EFA45A4DDE2485BE69A84DFF9DB0

SSDEEP:

3:N8cZTWiqGLduMu5VOXKngA2aA:2cZPpduMKOX8F2aA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SteamSetup.exe (PID: 2640)
      • steamservice.exe (PID: 712)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SteamSetup.exe (PID: 2640)

    • Executable content was dropped or overwritten

      • SteamSetup.exe (PID: 2640)
      • steamservice.exe (PID: 712)

    • Starts application with an unusual extension

      • SteamSetup.exe (PID: 2640)

    • Reads the Internet Settings

      • Steam.exe (PID: 2068)

    • The process creates files with name similar to system file names

      • SteamSetup.exe (PID: 2640)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 752)
      • chrome.exe (PID: 3452)

    • Manual execution by a user

      • chrome.exe (PID: 3452)
      • Steam.exe (PID: 2068)
      • sd.overlay.patch.exe (PID: 1656)
      • sd.overlay.patch.exe (PID: 1588)
      • sd.overlay.patch.exe (PID: 1876)
      • sd.overlay.patch.exe (PID: 1644)
      • sd.patch.exe (PID: 2452)
      • sd.patch.exe (PID: 3404)
      • 一键上号.exe (PID: 3344)
      • 一键上号.exe (PID: 2324)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3820)
      • chrome.exe (PID: 3452)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 3820)
      • chrome.exe (PID: 3452)

    • The process uses the downloaded file

      • chrome.exe (PID: 1928)
      • chrome.exe (PID: 3452)

    • Checks supported languages

      • SteamSetup.exe (PID: 2640)
      • nsCE35.tmp (PID: 2876)
      • steamservice.exe (PID: 712)
      • Steam.exe (PID: 2068)
      • sd.overlay.patch.exe (PID: 1876)
      • sd.overlay.patch.exe (PID: 1644)
      • 一键上号.exe (PID: 2324)
      • sd.patch.exe (PID: 3404)

    • Reads the computer name

      • SteamSetup.exe (PID: 2640)
      • steamservice.exe (PID: 712)
      • Steam.exe (PID: 2068)

    • Create files in a temporary directory

      • SteamSetup.exe (PID: 2640)

    • Creates files in the program directory

      • SteamSetup.exe (PID: 2640)
      • Steam.exe (PID: 2068)
      • steamservice.exe (PID: 712)

    • Reads the machine GUID from the registry

      • SteamSetup.exe (PID: 2640)

    • Reads CPU info

      • Steam.exe (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
33
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs steamsetup.exe no specs steamsetup.exe nsce35.tmp no specs steamservice.exe steam.exe chrome.exe no specs sd.overlay.patch.exe no specs sd.overlay.patch.exe sd.overlay.patch.exe no specs sd.overlay.patch.exe sd.patch.exe no specs sd.patch.exe 一键上号.exe no specs 一键上号.exe

Process information

PID
CMD
Path
Indicators
Parent process
712"C:\Program Files\Steam\bin\steamservice.exe" /InstallC:\Program Files\Steam\bin\steamservice.exe
nsCE35.tmp
User:
admin
Company:
Valve Corporation
Integrity Level:
HIGH
Description:
Steam Client Service
Exit code:
0
Version:
07.15.03.72
Modules
Images
c:\program files\steam\bin\steamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
752"C:\Program Files\Internet Explorer\iexplore.exe" "https://cdn.akamai.steamstatic.com/client/installer/SteamSetup.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3420 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=4516 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1588"C:\Users\admin\Desktop\sd.overlay.patch.exe" C:\Users\admin\Desktop\sd.overlay.patch.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\sd.overlay.patch.exe
c:\windows\system32\ntdll.dll
1644"C:\Users\admin\Desktop\sd.overlay.patch.exe" C:\Users\admin\Desktop\sd.overlay.patch.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\sd.overlay.patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1656"C:\Users\admin\Desktop\sd.overlay.patch.exe" C:\Users\admin\Desktop\sd.overlay.patch.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\sd.overlay.patch.exe
c:\windows\system32\ntdll.dll
1860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=4480 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1876"C:\Users\admin\Desktop\sd.overlay.patch.exe" C:\Users\admin\Desktop\sd.overlay.patch.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\sd.overlay.patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1928"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=4380 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
15 303
Read events
15 126
Write events
170
Delete events
7

Modification events

(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
14
Suspicious files
260
Text files
2 390
Unknown types
3

Dropped files

PID
Process
Filename
Type
3452chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF169b1c.TMP —
MD5:—
SHA256:—
3452chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
752iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:DF27BED4360EBE730C6F726E26DD3B4F
SHA256:92D4499AD3B0029A492DF4D25E78A7AD241BDFB02E4800B6D17A591AE5346915
752iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{01F5F6AC-C455-11EE-AE0A-12A9866C77DE}.datbinary
MD5:A5FD56BA11320AE897506FF9A63CD2FB
SHA256:34CE5009C6D80AB5F7F1841077EB145CD171442CB6538BD607028EC7ECA42B74
752iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:A1E0D07666D36FB36727F60DC0B3095C
SHA256:7230890A5BF83B5878B2D9AB6D94A234979D14D8D4F1DC57BB75B6498101D8EC
752iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3CD7126C93EC4B5F.TMPbinary
MD5:06668D0FFA736B56753FE6E7CC9C234A
SHA256:AC561D596D5A589C475F0D4B6D50371CB0B3F00736B8B8B645E568050AF473F5
752iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1FC5F643A92316FB87BEE154DC70EFA7
SHA256:FE7FC83D97379CCE69B26AC4B6F5273515F677DA29AEA65C57691971F4599ECF
752iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.datbinary
MD5:8D6B8FD2DD1AA0BF4750FEEF2F61F67F
SHA256:F0A3C2F5AFBE9965D6D87BF4F35210A7E2AE6D530813E6BBD26D8607386ADB0F
752iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3387B80255650BC9.TMPbinary
MD5:8BD8C49138872D1CCE6BE9FDCF1EE56B
SHA256:3681E4D7361B3429815A1FF81C45F88A981046E48E095702CC1D45F6B5820D41
752iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{1092C042-C455-11EE-AE0A-12A9866C77DE}.datbinary
MD5:C11377B237EA582A01E1A636857B5116
SHA256:897B8AD4BDC7FD27670B7C1F7AB90EB01A218121AF31F47F32726D6EB5E8CE3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
35
DNS requests
27
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
752
iexplore.exe
GET
304
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4c4bae6a1643aa04
US
—
—
unknown
752
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
US
binary
313 b
unknown
752
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
unknown
1080
svchost.exe
GET
304
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1dd404ff67a3d8ee
US
compressed
65.2 Kb
unknown
2068
Steam.exe
GET
200
184.24.77.33:80
http://media.steampowered.com/client/tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
DE
binary
5.31 Mb
unknown
2068
Steam.exe
GET
200
184.24.77.33:80
http://media.steampowered.com/client/resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
DE
binary
55.0 Kb
unknown
2068
Steam.exe
GET
200
184.24.77.33:80
http://media.steampowered.com/client/steamui_websrc_all.zip.vz.83cdfb92d0b35c6f6716c814b4aaf3ce19b8c4a7_23814718
DE
binary
22.7 Mb
unknown
2068
Steam.exe
GET
200
184.24.77.33:80
http://media.steampowered.com/client/resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
DE
binary
2.12 Mb
unknown
2068
Steam.exe
GET
200
184.24.77.33:80
http://media.steampowered.com/client/strings_en_all.zip.d58a1959149e8dd48d23a52052d3afa585a0416c
DE
—
110 Kb
unknown
2068
Steam.exe
GET
200
184.24.77.33:80
http://media.steampowered.com/client/resources_all.zip.vz.7b0b89dc9a451897160e0d1cdfcf6749dbf772cc_2858549
DE
binary
2.73 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3988
iexplore.exe
95.101.54.121:443
cdn.akamai.steamstatic.com
Akamai International B.V.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
752
iexplore.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
unknown
752
iexplore.exe
87.248.205.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
752
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3820
chrome.exe
142.250.185.195:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
3452
chrome.exe
239.255.255.250:1900
—
—
—
unknown
3820
chrome.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
cdn.akamai.steamstatic.com
  • 95.101.54.121
  • 95.101.54.208
  • 95.101.54.113
  • 95.101.54.216
  • 95.101.54.209
  • 2.18.64.207
  • 2.18.64.196
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.182
  • 2.19.96.130
  • 2.19.96.106
  • 2.19.96.91
  • 2.19.96.88
  • 2.19.96.112
  • 2.19.96.83
  • 2.19.96.107
  • 2.19.96.9
  • 2.19.96.80
whitelisted
ctldl.windowsupdate.com
  • 87.248.205.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
clientservices.googleapis.com
  • 142.250.185.195
whitelisted
accounts.google.com
  • 108.177.15.84
shared
www.google.com
  • 172.217.16.132
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
2068
Steam.exe
Potential Corporate Privacy Violation
ET USER_AGENTS Steam HTTP Client User-Agent
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.akamai.steamstatic.com/client/installer/SteamSetup.exe