File name:

steamtoolssetup.exe

Full analysis: https://app.any.run/tasks/6847effe-a645-4816-9a41-6b63a2f04610
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 24, 2025, 22:48:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
auto-startup
auto-reg
crypto-regex
xworm
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

69C7ADF3CDBC010EC49C5D70F18C2A1B

SHA1:

9C642BDF14D30B6D18E5CC7CB849F178B9FE2E87

SHA256:

C91FEC2BABA671461BC033211721C140D0337EAAA0A83092B4D83BAB2F9F9805

SSDEEP:

98304:nxMDn8E9v4E81lurz6yjL+etaegixgf3vYpeTWgxfRRReyTRoOOTIpVvym94y8Ud:Z7pKP/GUknIoPRL/yDcofHe0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 7360)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 7360)

    • XWORM has been detected

      • svchost.exe (PID: 7360)

    • Create files in the Startup directory

      • svchost.exe (PID: 7360)

    • XWORM has been detected (SURICATA)

      • svchost.exe (PID: 7360)

    • XWORM has been detected (YARA)

      • svchost.exe (PID: 7360)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • steamtoolssetup.exe (PID: 7308)
      • st-setup-1.8.16.exe (PID: 7492)

    • Reads security settings of Internet Explorer

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)

    • Reads the date of Windows installation

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)

    • Executable content was dropped or overwritten

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • st-setup-1.8.16.exe (PID: 7492)

    • Checks for external IP

      • svchost.exe (PID: 7360)
      • svchost.exe (PID: 2196)

    • Process drops legitimate windows executable

      • st-setup-1.8.16.exe (PID: 7492)

    • The process drops C-runtime libraries

      • st-setup-1.8.16.exe (PID: 7492)

    • Uses ICACLS.EXE to modify access control lists

      • st-setup-1.8.16.exe (PID: 7492)

    • Creates a software uninstall entry

      • st-setup-1.8.16.exe (PID: 7492)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 7984)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 8020)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 7360)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 8020)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 7360)

    • Connects to unusual port

      • svchost.exe (PID: 7360)

    • The process executes via Task Scheduler

      • svchost (PID: 7228)
      • svchost (PID: 6656)

    • There is functionality for taking screenshot (YARA)

      • SteamTools.exe (PID: 8124)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • st-setup-1.8.16.exe (PID: 7492)

  • INFO

    • Checks supported languages

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • svchost (PID: 7956)
      • st-setup-1.8.16.exe (PID: 7492)
      • SteamTools.exe (PID: 8124)
      • svchost (PID: 6656)
      • svchost (PID: 7228)

    • Reads the machine GUID from the registry

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • svchost (PID: 7956)
      • svchost (PID: 7228)
      • svchost (PID: 6656)

    • Creates files or folders in the user directory

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • st-setup-1.8.16.exe (PID: 7492)

    • Process checks computer location settings

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)

    • Reads the computer name

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • svchost (PID: 7956)
      • st-setup-1.8.16.exe (PID: 7492)
      • SteamTools.exe (PID: 8124)
      • svchost (PID: 7228)
      • svchost (PID: 6656)

    • Reads Environment values

      • svchost.exe (PID: 7360)

    • Disables trace logs

      • svchost.exe (PID: 7360)

    • Checks proxy server information

      • svchost.exe (PID: 7360)
      • SteamTools.exe (PID: 8124)
      • slui.exe (PID: 1616)

    • Creates files in the program directory

      • st-setup-1.8.16.exe (PID: 7492)

    • Auto-launch of the file from Startup directory

      • svchost.exe (PID: 7360)

    • Auto-launch of the file from Registry key

      • svchost.exe (PID: 7360)

    • Manual execution by a user

      • svchost (PID: 7956)

    • Create files in a temporary directory

      • st-setup-1.8.16.exe (PID: 7492)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 8020)

    • Reads the software policy settings

      • slui.exe (PID: 1616)

    • The sample compiled with english language support

      • st-setup-1.8.16.exe (PID: 7492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(7360) svchost.exe
C2107.172.44.175:1889
Keys
AES012
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexThMjqUyKmaZXuLR3
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:22 22:29:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 8675840
InitializedDataSize: 83968
UninitializedDataSize: -
EntryPoint: 0x84818e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: steamtools setup.exe
LegalCopyright:
OriginalFileName: steamtools setup.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
20
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start steamtoolssetup.exe #XWORM svchost.exe st-setup-1.8.16.exe no specs st-setup-1.8.16.exe svchost.exe schtasks.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs svchost no specs explorer.exe no specs explorer.exe no specs cmd.exe no specs conhost.exe no specs steamtools.exe svchost no specs slui.exe svchost no specs

Process information

PID
CMD
Path
Indicators
Parent process
1616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6656"C:\Users\admin\AppData\Roaming\svchost"C:\Users\admin\AppData\Roaming\svchost—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7228"C:\Users\admin\AppData\Roaming\svchost"C:\Users\admin\AppData\Roaming\svchost—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7308"C:\Users\admin\Desktop\steamtoolssetup.exe" C:\Users\admin\Desktop\steamtoolssetup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\steamtoolssetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7360"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
steamtoolssetup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(7360) svchost.exe
C2107.172.44.175:1889
Keys
AES012
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexThMjqUyKmaZXuLR3
7396"C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe" C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe—steamtoolssetup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\st-setup-1.8.16.exe
c:\windows\system32\ntdll.dll
7492"C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe" C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe
steamtoolssetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\st-setup-1.8.16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7724"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svchost" /tr "C:\Users\admin\AppData\Roaming\svchost"C:\Windows\System32\schtasks.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 601
Read events
7 589
Write events
12
Delete events
0

Modification events

(PID) Process:(7360) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:svchost
Value:
C:\Users\admin\AppData\Roaming\svchost
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:DisplayName
Value:
SteamTools
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:UninstallString
Value:
"C:\Program Files\SteamTools\Uninstall.exe"
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\SteamTools\Uninstall.exe" /S
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:InstallLocation
Value:
C:\Program Files\SteamTools
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:DisplayIcon
Value:
C:\Program Files\SteamTools\SteamTools.exe,0
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:NoModify
Value:
1
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:NoRepair
Value:
1
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\SteamTools
Operation:writeName:Language
Value:
1033
(PID) Process:(8124) SteamTools.exeKey:HKEY_CURRENT_USER\SOFTWARE\Valve\Steamtools
Operation:writeName:fScreenIndex
Value:
0
Executable files
20
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Core.dllexecutable
MD5:4BE563C65FF66351F94035D6B5624CC7
SHA256:C0EFDB388A3D1AAC1507B3DAABE63E7A3283AF81B1D1C04FDD1CA9F837882D51
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Gui.dllexecutable
MD5:47307A1E2E9987AB422F09771D590FF1
SHA256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
7492st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsoCBD0.tmp\System.dllexecutable
MD5:E74573CE106DD95B148BB8B1EF8E3418
SHA256:D12BC87BF84C51C13F0877949BCD719C5B90D9DF8658A2F8036DDC262CB0D87B
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Core.dllexecutable
MD5:817520432A42EFA345B2D97F5C24510E
SHA256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
7492st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsoCBD0.tmp\modern-wizard.bmpimage
MD5:3614A4BE6B610F1DAF6C801574F161FE
SHA256:16E0EDC9F47E6E95A9BCAD15ADBDC46BE774FBCD045DD526FC16FC38FDC8D49B
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Network.dllexecutable
MD5:3569693D5BAE82854DE1D88F86C33184
SHA256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
7360svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnkbinary
MD5:C42AE32B1A24DF57FF9E5295D4C09414
SHA256:2D90DB29B8F51DE8A3EB304CF3C6EFBAD663A8C4F7CBA477EEACE4DD2FD28466
7308steamtoolssetup.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:32A7C924D1FD14826740F4BDBAAB7B84
SHA256:54D3FBC258CC6CA53B5DBBDBE3F0224A13BE23AC0AFFAC4DFF469E7568E85CCA
7492st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsyCBBF.tmp —
MD5:—
SHA256:—
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\msvcp140.dllexecutable
MD5:BA72C2F6F465926980ADC2FB7F8B3490
SHA256:86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
8
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8124
SteamTools.exe
GET
302
59.83.212.226:80
http://new-service.biliapi.net/picture/chatres/update/version2.txt
unknown
—
—
unknown
7360
svchost.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
8124
SteamTools.exe
GET
200
8.133.135.83:80
http://stools.oss-cn-shanghai.aliyuncs.com/version2.txt
unknown
—
—
unknown
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7360
svchost.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
8124
SteamTools.exe
59.83.212.226:80
new-service.biliapi.net
CHINA UNICOM China169 Backbone
CN
unknown
8124
SteamTools.exe
8.133.135.83:80
stools.oss-cn-shanghai.aliyuncs.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
7360
svchost.exe
107.172.44.175:1889
—
AS-COLOCROSSING
US
malicious
2800
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1616
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
steamtools.info
  • —
unknown
new-service.biliapi.net
  • 59.83.212.226
  • 101.72.254.91
  • 119.188.209.64
  • 119.188.209.184
  • 175.43.192.134
  • 116.162.9.226
  • 123.6.40.124
  • 122.192.127.62
  • 119.188.209.185
  • 36.248.43.254
unknown
stools.oss-cn-shanghai.aliyuncs.com
  • 8.133.135.83
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7360
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7360
svchost.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
8124
SteamTools.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2196
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
8124
SteamTools.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7360
svchost.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
steamtoolssetup.exe