File scan report
Verdict Safe
Is steam.
No engines flagged this verified Valve executable, and its signer history, similar files, observed Steam processes, and fully checked network contacts support legitimacy.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Use the file if it came from Steam's normal installation or update process and the Valve Corp. signature remains valid. Otherwise, replace it with a copy obtained through Steam's official channel.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Valve Corp.
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
1 point against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the executable, including all 17 major contributors. Its verified Valve signature, five matching prior files, observed Steam components, and checked network contacts strongly support an authentic Steam client, while the generic sandbox technique mappings lack concrete harmful outcomes.
The executable carries a verified Valve Corp. signature, and all five historical samples associated with that signer were previously assessed as benign. None of the 71 antivirus engines that checked it flagged it, with all 17 major contributors silent. The completed sandbox run launched Steam-related components and did not issue a malicious verdict. Although it mapped process injection, file destruction, and data encryption techniques, no injected target process or destructive outcome was recorded. Every observed network host was covered by the reputation check, and none was identified as malicious or suspicious. The consistent signer-linked history, including another steam.exe, outweighs the unsupported behavioral mappings.
What We Detected
None of the 71 antivirus engines that checked it flagged the executable, including all 17 major contributors. The file has a verified Valve Corp. signature, and the available signer history contains five benign samples with no malicious examples. Five signer-linked files also received prior benign assessments, including another steam.exe.
Threat Behavior
One completed sandbox run launched Steam-related components such as steamsysinfo.exe and steamwebhelper.exe and did not return a malicious verdict. The sandbox mapped T1055, T1485, and T1486, but no injected process target or destructive result was recorded. The persistence alert points to Valve's SuppressAutoRun registry setting rather than a demonstrated scheduled task. All ten distinct observed network contacts were reputation-checked, with no malicious or suspicious matches.
What To Do Now
The file can be used if it came through Steam's normal installation or update channel and Windows continues to show the valid Valve Corp. signature. If it arrived from an unrelated download site, obtain a fresh copy through Steam's official distribution channel rather than relying on the filename alone.
Where this verdict could be wrong2 caveats
- The sandbox mapped T1055, T1485, and T1486, but recorded no injected target process, no malicious runtime verdict, and activity consistent with Steam components.
- Ten dropped files lack saved verdicts, so their individual reputations remain unknown even though no file it created is currently identified as malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the executable.
- The digital signature is valid and belongs to Valve Corp.
- All five available samples associated with this signer have benign histories.
- The sandbox launched recognizable Steam components and returned no malicious runtime verdict.
- All observed network contacts were covered by the reputation check, with no malicious or suspicious matches.
- Ten dropped components do not yet have individual saved assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 5spawned processes
- 10network contacts
- 32filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1202
- T1485
- T1486· File encryption
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
steam.exeC:\Users\<USER>\Desktop\steam.exesteamsysinfo.exeC:\Users\<USER>\Desktop\steamsysinfo.exe -steamid 0 -buildid 1788400362 -logdir C:\Users\<USER>\Desktop\logs -nocrashdialog -query 1 -out-file C:\Users\<USER>\AppData\Local\Temp\75C2.tmpsteamwebhelper.exeC:\Users\<USER>\Desktop\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\<USER>\AppData\Local\Steam\htmlcache" "-steampid=4652" "-buildid=1788400362" "-steamid=0" "-logdir=C:\Users\<USER>\Desktop\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\<USER>\Desktop\clientui" "-steampath=C:\Users\<USER>\Desktop\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\<USER>\Desktop\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.…steam.exe"C:\Users\<USER>\Desktop\steam.exe"steam.exe"C:\Users\user\Desktop\steam.exe"
Network contacts
1010 hosts, listed as 3 domains, 7 addresses, 2 links. Links show the host and path only.
- Domain
client-update.steamstatic.com - Domain
yr.c.lencr.org - Domain
yr1.c.lencr.org - IP address
199.232.211.82 - IP address
23.47.72.17 - IP address
104.18.21.213
Show all 12 entries for network contacts
- IP address
23.47.72.6 - IP address
23.14.93.118 - IP address
199.232.215.82 - IP address
104.18.20.213 - URL
http://yr.c.lencr.org - URL
http://yr1.c.lencr.org/71.crl
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Desktop\logs\bootstrap_log.txt - Written
C:\Users\<USER>\Desktop\.writable - Written
C:\Users\<USER>\Desktop\.crash - Written
C:\Users\<USER>\Desktop\logs\cef_log.txt - Written
C:\Users\<USER>\Desktop\logs\steamui_html.txt - Written
C:\Users\<USER>\Desktop\.temp_write_b032c961
Show all 30 entries for files
- Written
C:\Users\<USER>\Desktop\logs\steamsysinfo.txt - Written
C:\Users\<USER>\Desktop\logs\webhelper.txt - Written
C:\Users\<USER>\AppData\Local\Steam\htmlcache\BrowserMetrics\BrowserMetrics-6A98DBB8-4E0.pma - Written
C:\Users\<USER>\AppData\Local\Steam\htmlcache\lockfile - Written
C:\Users\<USER>\AppData\Local\Steam\htmlcache\Variations - Written
C:\Users\<USER>\Desktop\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342 - Written
C:\Users\<USER>\Desktop\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671 - Written
C:\Users\<USER>\Desktop\package\strings_en_all.zip.071a3f6839c3b8d574731101f2862d5ed72ab2e4 - Written
C:\Users\<USER>\Desktop\package\resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108 - Deleted
C:\Users\<USER>\Desktop\.writable - Deleted
C:\Users\<USER>\Desktop\.forceupdate - Deleted
C:\Users\<USER>\Desktop\steam_appid.txt - Deleted
C:\Users\<USER>\Desktop\bin\avutil-51.dll - Deleted
C:\Users\<USER>\Desktop\bin\avformat-53.dll - Deleted
C:\Users\<USER>\Desktop\bin\avcodec-53.dll - Deleted
C:\Users\<USER>\Desktop\.temp_write_b032c961 - Deleted
C:\Users\<USER>\AppData\Local\Steam\htmlcache\BrowserMetrics-spare.pma - Deleted
C:\Users\<USER>\Desktop\package\tmp\aom.dll_ - Deleted
C:\Users\<USER>\Desktop\bin - Deleted
C:\Users\<USER>\Desktop\package\tmp\bin\audio.dll_ - Deleted
C:\Users\<USER>\Desktop\package\tmp\bin\audio64.dll_ - Deleted
C:\Users\<USER>\Desktop\bin\cef - Deleted
C:\Users\<USER>\Desktop\bin\cef\cef.win64 - Deleted
C:\Users\<USER>\Desktop\package\tmp\bin\cef\cef.win64\chrome_100_percent.pak_
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\ActiveProcess\pid - Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\ActiveProcess\SteamClientDll - Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\ActiveProcess\SteamClientDll64 - Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\SteamExe - Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\SteamPath - Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\SuppressAutoRun
Show all 16 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\Restart - Set
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\StartupModeTmpIsValid - Set
HKEY_CURRENT_USER\SOFTWARE\Chromium\StabilityMetrics\user_experience_metrics.stability.exited_cleanly - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Valve - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam - Set
HKEY_CURRENT_USER\Software\Valve - Set
HKEY_CURRENT_USER\Software\Valve\Steam - Deleted
HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\OSVersionUnsupported
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
Local\ChromeProcessSingletonStartup!\Sessions\1\BaseNamedObjects\DBWinMutex
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- df0118e429eeffdad00e…5e4c26Not checkedno saved verdict
- 0c6dbf35a61502b59da0…dadc62Not checkedno saved verdict
- 954f93cc81ea2e09f032…25e2fbNot checkedno saved verdict
- a775e183d51d18fd0db5…1799cdNot checkedno saved verdict
- ac62e3d0e6213bcbdcfe…4ea93bNot checkedno saved verdict
- e1fee3beffa9d08a415a…889bd7Not checkedno saved verdict
- ce3d32710b6c239f29b8…73412dNot checkedno saved verdict
- 2f864611352cd7b438fa…c25cb2Not checkedno saved verdict
- 90bbf86f1cf8dd35cc36…b6085fNot checkedno saved verdict
- 6b82102920ccda09e803…441952Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Valve Corp..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 15, 2026, 4:13 AM UTC
- SHA-256
48ea0576865d2dfda26001b7b210c3f7559d46e647424cd11704eb1ea842fe5a- SHA-1
e51df4fe8523815ec348928eeff6456456759bb5- MD5
b71018f404b569832bf62f280dcde935
About this file
steam.exe is a Win32 EXE file of 5.8 MB.
- Type and size
- Win32 EXE · 5.8 MB
- Signer
- Valve Corp.Valid code signature.
- First seen
- Sep 3, 2026On VirusTotal.
- Submitted by
- 475 distinct sources
- Packer
- None detected
- Entropy
- 6.42 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is steam.exe safe?
What is steam.exe?
How many antivirus engines detected steam.exe?
Is steam.exe digitally signed?
What is the SHA-256 hash of steam.exe?
Is it safe to run steam.exe?
How up to date is this analysis of steam.exe?
Community
Member reviews and reports for this exact file hash.