home

steam.exe

Steam Client Bootstrapper

Valve

This is a setup program which is used to install the application. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Steam’. The file has been seen being downloaded from www.giftnewgift.com and multiple other hosts.
Publisher:
Valve Corporation  (signed by Valve)

Product:
Steam Client Bootstrapper

Version:
03.49.64.60

MD5:
adb8d21fc136bc4092a7f87dd4426f50

SHA-1:
77b2a641d6bf5e3209419e12a00a9b0f7e90bdb2

SHA-256:
8f63147eed8ccd5ce076491c78559ecb1a3953769f56b3191167e6c549ce8129

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
11/24/2024 2:33:16 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
c:\users\test\appdata\local\temp\2c5b9fabf3c681db0b0b1c614f8cde1843b1ec82 c:\users\test\appdata\loca
9.0.1.05190

File size:
2.8 MB (2,917,456 bytes)

Product version:
01.00.00.01

Copyright:
Copyright (C) 2010 Valve Corporation

Original file name:
steam.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\steam\steam.exe

Digital Signature
Signed by:
Valve

Authority:
DigiCert Inc

Valid from:
9/25/2015 2:00:00 AM

Valid to:
10/3/2018 2:00:00 PM

Subject:
CN=Valve, O=Valve, L=Bellevue, S=WA, C=US

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
084CAF4DF499141D404B7199AA2C2131

File PE Metadata
Compilation timestamp:
6/15/2016 1:24:28 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:u3OGkLl0P01tp4DljwW2AgVj0Vbkfj8wnJQYZ6Q4gHpyE9lOPYmy7mE+N6oj+aYW:g8us1tp4zxpVbkfjHJQg4gJyO9pmd

Entry address:
0xC72BB

Entry point:
E8, C2, E2, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, E8, C3, 64, 00, E8, 1F, 3D, 00, 00, E8, 30, 5E, 00, 00, 0F, B7, F0, 6A, 02, E8, 55, E2, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 78, 26, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
1.8 MB (1,841,152 bytes)

Scheduled Task
Task name:
{0ED04785-6655-4DE5-9A7B-7DB546D256FB}

Trigger:
Registration (Runs on registration)


Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Steam

Command:
"C:\Program Files\steam\steam.exe" -silent


The file steam.exe has been discovered within the following programs.

ARK: Survival Evolved  by Studio Wildcard
www.playark.com
About 8% of users remove it
BattleBlock Theater  by The Behemoth
www.battleblocktheater.com
About 1% of users remove it
Braid  by Number None
braid-game.com
About 6% of users remove it
Call of Duty: Black Ops II - Multiplayer  by TreyArch
www.callofduty.com
About 1% of users remove it
Call of Duty: Black Ops II - Zombies
About 5% of users remove it
City of Steam: Arkadia  by Mechanist Games
www.cityofsteam.com
About 5% of users remove it
DiRT 3  by Codemasters Racing Studio
www.dirt3game.com
About 9% of users remove it
DiRT 3 Complete Edition  by Codemasters Racing Studio
About 3% of users remove it
Elite Dangerous  by Frontier Developments
www.elitedangerous.com
About 3% of users remove it
Grandia II Anniversary Edition  by GAME ARTS Co., Ltd.
www.gunghoonline.com/games/grandia-ii-anniversary-edition
About 2% of users remove it
 
Latest 20 of 18 programs
Powered by Should I Remove It?

The file steam.exe has been seen being distributed by the following 4 URLs.

http://www.giftnewgift.com/g3ms8PAxJ4wB0scvz_Vzol1E_xvDK6d__NPTENenBxaTBa1ql7S7zWxJFaAFSwWrPZ1IFqcb8pvJV3LKJ2BB4XVMFYAwr2YipCg0SPHMQPTfIaIVSNkqeh4L3ocZTX44q5jHwto3jYVq6zUZdFuMve4y0naM0BALgyHXFOfThzTWlM6g0HVC84n5dhNSm5CwXKIjoDpAyEydik7mOq_xpOcutE2D7JI IV 84R5Msu9EPVPgFQIrwSshsY7NR5MMQIJbvqXtqeh7V93HbkYaUPYbDKxmv59A 7salP0eDGdovPM5Ik9PAQDp9uYEvgUIePePwblTU9yF5FdmzcXKoEXZiPGInuVxX 7iHZLasdRgzAFXb E6AZviDPXG6jfcbaOQ3DW7Ybc2alFhDoSqdIsn0EogbQMWmPwLyZojbCH7GnByykYyc35QNdZBiBjDkjkkYYHbmtY8daDBi6SfSxxUE gQvoQUX7NyrDS50QJxOxW8zqIqruxGiINLOCUz5uS6oWlzUdO0kX6aymAXxQMBfrXmMQ==-G4oAAGRpXUu7KD1cOgCdHDh8D_oCuiccph5YesP2uaGYks B2zjfmo2fH2cc3 OjsxMKBpZBQSFLNVHvNrY4HjmJ_28v3_N_2j6cnxoJLg387yGbKkfY8zHGg4dCCg==-e

http://www.centraltourrepository.com/qQuJDQ3kQBhmQWbaiwkYvM 6eXGTeg755RdSek4XNDJcCo10lsgTOYZNQJ1kCzW_LV1JvQGDoFcB7GnKhjBMc59sssC79_QFY_qpLd3eUZeTWW2G7veT_AdapHVLts49ySgR jr9AfWfTyQP9lYgYxE GR0eizMw5KNlMKwY_hTxGPJV6ZCToDG6NjFQJwIENS9JdZx8yZiyIFRMZHPjZaQx7pfNxszg3y8tFY7wo9TTlum_e8Qq CpOTpCk6y40u4SwVwe IxvWYB4CVeSaE20OINdG4ejeVl9GB8xprcJEilglmHn8NUTxVhbbrsxyGMseJD6jgzhUp4JTbQGur9lRyridfIJHcMj2 byeo JZfHcBRct7b4nO5pdjURK6VGmwOuFwnO4 3VDYbEkcXGVtCwF6WL6c7IfkqT_ECec2Wpvi5KkaBdCk8qCJDQvsZ5ZAQBKEcYrUlFZe QMVRSmCfq0afxUACWM5A6U6 JciPdKQM1U=-G5YAAGRpXUu7CL9cKoA3TodB7R6 adyGQQYZZ15vmM NFVPyOfA21rdm437DGdf3 NTZgDSHJLaAVQGW9CPOopdjJgTTn4T_t5fv T9t789PjZSuDvLffWZejnPOx4gLJ_PpAA==

http://s10150.chomikuj.pl/File.aspx?e=8bNQO30bN1Q-WIYYvaFSbPZvMXok2JImyAiWdjHoJy-rN5cJuVDRDMC1PpJytyhjzpG0vuVgYEMVoJxY5ZW1KLzqGacsbH-fGWa_9RqZ346MRzAj0Zl-yyNQubb7gZ4iZ1KMWNSgAOUqcdoTZ2bRKXT0fegMOHFUN3oCpg9CFVnhMCoYIa01MRwsssZIm32tvfgt1-Zk3j8nq8j6CqQUVrFd1oH8Y5fi_rG6isiM0nXPoG0GogkEzNWJH3Er9j_YX5fJTgaDUfWEq93oTz9NVXbJ-4E4nD5l2Hw8w6xKmPsjlLSd9U2Ps-ZIyzMW_vbD4B4r6fSnhye3yRjRVQwsr0pHm8zqtSXnupw0Zh1CGDOxjhIJ9Ldgnrg2CqDTWbBh75BapkZS91AlVDNdm--aOw&pv=2

https://doc-0g-5g-docs.googleusercontent.com/docs/securesc/3v1urlc7fefb1v7kdc06n050sk698sb2/ud5ac7oni599bfe6jm0f9juf1g619go7/1466193600000/.../01027074358087809757/0B2QBDhi4dxmkYk54NnYxSVlReG8?e=download&nonce=dh92699ukgb4i&user=01027074358087809757&hash=bjqit9g86tmje8dbbf5o32jes32a7ura

Scan steam.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.