Analysis
- user interaction
yes - max time kernel
105s - max time network
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 09:45
Behavioral task
behavioral1
Sample
SteamBoosterSetup(1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SteamBoosterSetup(1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target SteamBoosterSetup(1).exe
- Size 4.1MB
- Sample260801-lre3msgq9t
- SHA256 a6686c497e7312610b52a40e5f20365bbfde405dcfd92132bae87715366b178b
- MD5 537fa9b4f8304ece16bb4b8bc3cea839
- SHA1 13c4fd14585ab3e201795bab18fd3a82512fe3d4
- SHA512 10f42b7edc12b963200f7ad61f3c722598224e2ce1eadabfb358c1fda43f0da2d853e487b1849480220885fb291ee61379a2b23082c159160e4dd2fd81aef615
- SSDEEP 98304:amXxXXXXXX2dhtpAsWILY9tCeu/P21DUSyRPcKe5X428bEpXK4dvLg0lS0:LXKLEu/P21DUSyRPc55Xdqh0
- TLSH T13E168D27A7E801F8C0B7C1B9CA578623E77274191335A7DF1AE08A561F236E16E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 2784 steambooster.exe 428 steambooster.exe 4740 steambooster.exe 2900 steambooster.exe 5460 steambooster.exe 1060 steambooster.exe 7140 steambooster.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\steambooster = "\"c:\\users\\admin\\appdata\\local\\steambooster\\steambooster.exe\" --autostart" SteamBoosterSetup(1).exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\IconUri = "C:\\Users\\Admin\\AppData\\Local\\steambooster\\app-icon.ico" steambooster.exe Set value (int) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\ShowInSettings = "1" steambooster.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\AppUserModelId\SteamBalance.SteamBooster steambooster.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\AppUserModelId steambooster.exe Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\AppUserModelId\SteamBalance.SteamBooster\DisplayName = "SteamBooster" steambooster.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3788 firefox.exe Token: SeDebugPrivilege 3788 firefox.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 3788 firefox.exe 3788 firefox.exe 3788 firefox.exe 3788 firefox.exe 3788 firefox.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe 2784 steambooster.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3788 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2784 1988 SteamBoosterSetup(1).exe 89 PID 2436 wrote to memory of 3788 2436 firefox.exe 105 PID 2436 wrote to memory of 3788 2436 firefox.exe 105 PID 3788 wrote to memory of 5248 3788 firefox.exe 106 PID 3788 wrote to memory of 5248 3788 firefox.exe 106 PID 3788 wrote to memory of 5248 3788 firefox.exe 106 PID 3788 wrote to memory of 4492 3788 firefox.exe 107 PID 3788 wrote to memory of 4492 3788 firefox.exe 107 PID 3788 wrote to memory of 4492 3788 firefox.exe 107 PID 3788 wrote to memory of 4492 3788 firefox.exe 107 PID 3788 wrote to memory of 1276 3788 firefox.exe 108 PID 3788 wrote to memory of 1276 3788 firefox.exe 108 PID 3788 wrote to memory of 1276 3788 firefox.exe 108 PID 3788 wrote to memory of 1276 3788 firefox.exe 108 PID 3788 wrote to memory of 3212 3788 firefox.exe 109 PID 3788 wrote to memory of 3212 3788 firefox.exe 109 PID 3788 wrote to memory of 3212 3788 firefox.exe 109 PID 3788 wrote to memory of 4560 3788 firefox.exe 110 PID 3788 wrote to memory of 4560 3788 firefox.exe 110 PID 3788 wrote to memory of 4560 3788 firefox.exe 110 PID 3788 wrote to memory of 4560 3788 firefox.exe 110 PID 3788 wrote to memory of 6180 3788 firefox.exe 111 PID 3788 wrote to memory of 6180 3788 firefox.exe 111 PID 3788 wrote to memory of 6180 3788 firefox.exe 111 PID 3788 wrote to memory of 6180 3788 firefox.exe 111 PID 3788 wrote to memory of 6224 3788 firefox.exe 112 PID 3788 wrote to memory of 6224 3788 firefox.exe 112 PID 3788 wrote to memory of 6224 3788 firefox.exe 112 PID 3788 wrote to memory of 6224 3788 firefox.exe 112 PID 3788 wrote to memory of 6240 3788 firefox.exe 113 PID 3788 wrote to memory of 6240 3788 firefox.exe 113 PID 3788 wrote to memory of 6240 3788 firefox.exe 113 PID 3788 wrote to memory of 6240 3788 firefox.exe 113 PID 3788 wrote to memory of 6248 3788 firefox.exe 114 PID 3788 wrote to memory of 6248 3788 firefox.exe 114 PID 3788 wrote to memory of 6248 3788 firefox.exe 114 PID 3788 wrote to memory of 6248 3788 firefox.exe 114 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SteamBoosterSetup(1).exe"C:\Users\Admin\AppData\Local\Temp\SteamBoosterSetup(1).exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\Temp\SteamBoosterSetup(1).exe" --parent-pid=1988 --bootstrap-handoff2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2784
-
-
\??\c:\users\admin\appdata\local\steambooster\steambooster.exe"c:\users\admin\appdata\local\steambooster\steambooster.exe" --autostart1⤵
- Executes dropped EXE
PID:428
-
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"1⤵
- Executes dropped EXE
PID:4740
-
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"1⤵
- Executes dropped EXE
PID:2900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1132
-
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"1⤵
- Executes dropped EXE
PID:5460
-
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"1⤵
- Executes dropped EXE
PID:1060
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {1f6c4e2f-ea12-4899-9240-59f356707ff8} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:5248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {b03e03a5-ac0f-406a-8f4d-c637c76c971d} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:4492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {3873b8a3-fef8-4e8e-99a7-3df8ce0f9867} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:1276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {88e7a08a-75f9-421a-a047-27c858ac6b15} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3160 -prefsLen 34773 -prefMapHandle 4508 -prefMapSize 270279 -jsInitHandle 4512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4520 -initialChannelId {3108fb75-e7b1-432f-b02f-05bab02ea755} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:4560
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4616 -prefsLen 35010 -prefMapHandle 4608 -prefMapSize 270279 -ipcHandle 5048 -initialChannelId {60f9cfdb-bc1b-4c02-b648-36c6ea280474} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:6180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32952 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {21237834-85c6-4735-8531-d3e9b3a1bcb4} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:6224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32952 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2812 -initialChannelId {d0bb52f7-3e81-48ed-9473-09660143854e} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:6240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32952 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {9e338fcd-be48-4158-bc73-c44b3fe315fb} -parentPid 3788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:6248
-
-
-
C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"C:\Users\Admin\AppData\Local\steambooster\steambooster.exe"1⤵
- Executes dropped EXE
PID:7140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-01.log
- Size 3KB
- SHA256 cefec8aec92534a0ed7bf28c61bdf2edfb408b22d981db5461a75ba9f45b2452
- MD5 952b75c382d9b6c3e52e2564515804d5
- SHA1 db46e56b171f5b2cc5e3e08bf6fa73448b2a2ead
- SHA512 26a899cf55499255c20e3adacba0ee04ce6dd73c9531bda252c794506f2848fac32d3033420c92d955844c9552fdecee7637dfc93d30af80c5fcc628ab22f0b3
- TLSH T18C612C6A9CD778F75F038A16E5873A572C1274B3EC55A1B8BFF5AC08500791A8EC2E13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-01.log
- Size 3KB
- SHA256 297fdc9767f25cfae9d3741596fca215c7cd5e6ca9537acabe8392685a811cb5
- MD5 a1b02a072a4c121b8e315f2070f56d8e
- SHA1 4b394aa0882a7c31f75926536294838526a7b3a8
- SHA512 4d941bbe6936987d0588abb1d7e347244b06a096007eacdddc7357307b41106bd0e685766e8e31e0de58e3d16eee17461dee8b7b3ad604c18df5398fbed43e00
- TLSH T199714D6A98D778F75F038A16E5873A572C1274A3EC5591B8BFF46C08500B91B8EC2E13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-01.log
- Size 4KB
- SHA256 2823ed25945f582689e8f5163c7afedda82a7b4fd3d6e35c7c231b2599ae1f28
- MD5 472ad5df2bcff384877965f33c7e8cb7
- SHA1 f98f977f99caf11cde6064ff38a60f37aa45683f
- SHA512 e4777cc27be6cd91be382d65490431afde1c04173f1699cc5fb7d4dafeff755066f4afabb3d5e56b4e9ab0c774809c9bb1fe9c94076b961473bd84b7574c038e
- SSDEEP 96:KhrTSNvZhNDqVr9TNGZrRSNRqhdtQ62hC/p8pr2SNhBCrbSNvUrrSNzE:EivZhNDq3GZsRqhdy3hMMFhY6vUyzE
- TLSH T133A12D6998D778F75F138A16E4873A572C0674A3EC55A0B5BFF8AC08500B91B8FD2E13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-01.log
- Size 5KB
- SHA256 589ee31ade50e3d63c2ae60703e76d224017f222d8165a355d73dba6cd8518ff
- MD5 9984b415ed84ea730a8222390ed2bc0a
- SHA1 fe5ec2070ef870a809d7b4dd4f27151b7428dc6a
- SHA512 3ee27628d3633650b86545fcd9cc8a170fe2f1df168e7c95978a7107d64c02d3c339b92217ae0586c641486815f1c7dbb2c9425c467e39a746e8066762b9e8a1
- SSDEEP 96:KhrTSNvZhNDqVr9TNGZrRSNRqhdtQ62hC/p8pr2SNhBCrbSNvUrrSNzVrmSNjE:EivZhNDq3GZsRqhdy3hMMFhY6vUyzVlo
- TLSH T1BCB12C6998D778F75F138A16E4873A572C0674A3EC55A0B5BFF8AC08500B91B8FD2E13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-01.log
- Size 5KB
- SHA256 f906635ee6b7594ef514dce111f4f7792907e07e525ac8287d5247ae12adbc46
- MD5 e464db1d225d112d354fe98d7b1da273
- SHA1 60fb47606383522f318347625b36a2fb82cdaf41
- SHA512 60aee3d6097e041c84cff67c85b5437e5f5ec6bad16346ceaf26f37ce2a4a91a61f85169dd331dde33dd8745c6070fc98818f783d961931f8f6fcb0b80058d02
- SSDEEP 96:KhrTSNvZhNDqVr9TNGZrRSNRqhdtQ62hC/p8pr2SNhBCrbSNvUrrSNzVrmSNj/rY:EivZhNDq3GZsRqhdy3hMMFhY6vUyzVlA
- TLSH T167C12E6959D778F75F038A16E8873A572C0674B3EC55A0B5BFF8AC08500B91B8FD2A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\logs\steambooster_2026-08-01.log
- Size 1KB
- SHA256 7ffeaf358fb06440b31d53c0c58ac89a48932ecb435bb0fd55426125833e8482
- MD5 d7b059b58309d3895e3ef3a48738edc8
- SHA1 4db3f2500af40151b499dcdc491bdadb1e9324e7
- SHA512 ccd466fcc55b21bada8da2a19e5b129884dd0e57bd34e44dd1e8424b7cbfe57b40f734e7e3f318b9c800b2a856a2a9c10c533f8718277eb4dc5f90836457010d
- TLSH T1CE1137AA4CD778A36F128626D9873E172C117072DCA5A1B8BFF57C09905A90A8EC2D03
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\steambooster\steambooster.exe
- Size 4.1MB
- SHA256 a6686c497e7312610b52a40e5f20365bbfde405dcfd92132bae87715366b178b
- MD5 537fa9b4f8304ece16bb4b8bc3cea839
- SHA1 13c4fd14585ab3e201795bab18fd3a82512fe3d4
- SHA512 10f42b7edc12b963200f7ad61f3c722598224e2ce1eadabfb358c1fda43f0da2d853e487b1849480220885fb291ee61379a2b23082c159160e4dd2fd81aef615
- SSDEEP 98304:amXxXXXXXX2dhtpAsWILY9tCeu/P21DUSyRPcKe5X428bEpXK4dvLg0lS0:LXKLEu/P21DUSyRPc55Xdqh0
- TLSH T13E168D27A7E801F8C0B7C1B9CA578623E77274191335A7DF1AE08A561F236E16E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 1bcfe4fa107dbd0e8ad3ac640e5c404d72ba1c1573e4056a6030898940a440f4
- MD5 351cbf8414f15b47e6892afdc9c9ffff
- SHA1 acdfdfef596d6f3f07f8addadc8044d0a6dea752
- SHA512 80109da7892c0f60a975e2a2a964c2cb93f4a7f5e6ce63b2018ade439de928b543ad5eef3c01a0ab42d996053c2bc69e8220b6e4ac82b1d06135f5a1cead3068
- TLSH T1E5418B2156FC1A61E37ACCB965B35195D574B870BF0BCA1D034891CC0D31A60BE26F0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SteamBooster by SteamBalance\Удалить SteamBooster by SteamBalance.lnk
- Size 2KB
- SHA256 fe2c4eb0e603c3d390e9ba3be097967bfbe2c63e446ad134749381f3989160d7
- MD5 839e99c4241b5f60f1799e7357072aef
- SHA1 61468b623267e855986a50b9606923f8d5dda685
- SHA512 b2a16e8966f889ed6dc9820e2b3f47d9358effc06ce032755bdc5a6ad04132872de57c812978843952abf887ab7a90f2e1e954837b813f158a42e573685b7860
- TLSH T141418B2156F81A60E37ADCB965B25196D974BC70BE0BCA1D034881CC0C31A64BE66F0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 34e8fdbfed91c4a1541ec146c11a97acf27c523b6e8c550c31350495e2cffc25
- MD5 c03760132555f586d6fadfa55d2a9532
- SHA1 fe549de4955df8b96bebbe43bf918cbb5ade99b9
- SHA512 f3dca31dd248688abf3f2b9c8279474b025536fb288e6bc8fb92ea5dab3e1d196091717c759bb3d19527694e2c05cbcb48025b1d19d628b1f80ff152ffe30d75
- SSDEEP 192:FOv5zbofZpRyj9xxbd1d66JoztdzgCl6mc0dz:abofZpRyjpd66Joz/zgC1jd
- TLSH T1EED1EC58F628863BD419023BCCA61F510E35388A989E3F1572EC640D2D572DE7A8E27E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 b455393cc6a022d11bae40cedb5b79f4eb78d9888930ea2f1a8905cb0a9ac09d
- MD5 7651c492c09e7ad5ce775474449556ad
- SHA1 47c64d9504574815aa20cc4888b52da21aafa9e2
- SHA512 102bd32ce23f078ac2d053012e5b0c6fef84d0142ef59217df037a391ca62b4c5927c21a8f1c1ca91aad33b108bc019aa5832d9559258aa67090e7dd06095d89
- SSDEEP 192:3bd1d66JoztdzgCl6mc0djOv5zbo7LZpRyjt8w:fd66Joz/zgC1j+bovZpRyjh
- TLSH T1CCE10D64E628863BC418027BCCA61F414E39388A9C4E3F19759D650C2D572DE7A8E2BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 5a7f869ba8dae95a5334ac49b80bd60678f05e54fe82ccf609f132b4adf69aa5
- MD5 37d600e53cf2a83b1e53127c61412985
- SHA1 a435a2f63071ad72ffb80e0d6baa52e73b79bacd
- SHA512 98cbf15b44b580e2e712d9050c5058470d6baee0248ac410e60108f7323bb30a0c6ac6ca4dd0e26c2c1a1c18567cb1f70ed6fbe2d3c6c3ca1d3337f80f9b2008
- TLSH T19421319C3AF94D2A6CC7F79CB491128E63654E0B45471C534D12EF8DCE91AD931AD43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\06e81645-2e23-45ad-bb60-66003818a21e
- Size 235B
- SHA256 28c53ecd6a613ca5aa7e524d93c8d1f4e6ee3cad775d59218ea100b62de2aa8d
- MD5 4c0a9aa4e3b1bd53e5b5a737ed065ae9
- SHA1 3a8671b51a8c001b48b5ae0029614c89f05548ca
- SHA512 7954ec0d21dae633ad8d7af788239478928ff35d77a4fb8adb48f14493612d330b6269c04d99240e5dc1bb12525d3d8dde34f6d37f9753ca43e0ed09cc7987c1
- TLSH T160D09794249C2B5D08180F13F0A06CC230944C3314B8A8288EB044749AFCDC44131C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\1a8f8bd3-0b07-4afe-9224-69377e4b6e9e
- Size 16KB
- SHA256 e156e65a12cea72bd7c5a0a4e287f70cf0706349507ad7b39a7669d470c66395
- MD5 1c389d9b982107ca9dddc89a5ca6c30f
- SHA1 f889a3c42ea4b1bbda5eb5e98da7fbeda4e7a3ec
- SHA512 98873daf934af5c99751b45e55467ae7d15e33e5b17fa5050f1b667f1bbc556c524a8a7808064fdca8c08096897571b390db4fa04c93fed4e01ec9c32e109704
- SSDEEP 192:4R9x9YuXL6U5WZeRAn8sM3sTRQwFSp7KhCzxnlkQV4nHiK0NJ9QXBBSY5T140M1S:ilMSp7K0lnlHVwCKBch5A3n
- TLSH T17672C9566820497AC250E368D4FC7FC7E6F528CB4C419FCA9BE4BE086DDE06D512788B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\486085c9-6aac-4e3d-a396-b7c0b53c53d1
- Size 883B
- SHA256 05c1875a6c10c7c96f7b831e6d25df1cbf59c4899e99616139250db47723d9f0
- MD5 70eb3d06935ccf00bed086ae7342e51b
- SHA1 5143034ea3e6bdc8da47bdab22eecc29a87940d7
- SHA512 18147da2c8bb8db30104e1694873f80819711cfcbf51473c0c675e2ce3882e3a69d058566e8c0ff2b34b0abd03726bb3b90d49fbe7b81dd650d0bf309ed40cf3
- TLSH T1011100409530B6A2CD69D29FC8943F02CAF8B92380CA44103DA14F084FAE52F97AA60B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\4ebcac9c-2c57-4b3c-ae06-b58a35e41f04
- Size 2KB
- SHA256 5aaea770159932829e5bb4ee78dd241c1b35c4eba9a95eae6a96a3c5a7078938
- MD5 5e6c85a7e77fd66b54eee7abea9d0ba9
- SHA1 2a28a32df791670466c2c32161eb44de7c1ca246
- SHA512 ae5fa9c19aa6ab2e7b81667b687d0eaafb93bff7add68e7adef3258fee53503e5148f7694cfcf25c6f3f8c3fce158bfcbe203fa9d5c2f8b42a43ee39ffccde6b
- TLSH T1B341239834748E769CDAE59D9442378FD3749A1304C71C832D51EF0CCD97A9E236A52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\57e5eb80-c5e7-494d-90eb-4e47067405cd
- Size 235B
- SHA256 53faa3fdf658217d0bfdd546a2a548b37c959a205f9ade1404e1de8e5547c991
- MD5 a54922d5c348e656b4a2e0086f06b7b3
- SHA1 c496ff36052e59f763279b8de42d28d9b7d98dce
- SHA512 a6991d9963a421a719b8590e935d8d6be92fa7d7ac102febac861aa0d2a66977915007e868ec39e94696267b8ef4b8f05b8ebf5bcfcb7d2f84a0d92573e55d4e
- TLSH T1D3D0978168A82B2C08200F02F0B8BCC6708D4C3310B8A820DA614038DAF9EC4019186A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\e6fc1ed7-29d0-47c9-827f-033a64c05c5d
- Size 886B
- SHA256 1ad08b4f6eea692ba792b619b28f711a4012d18f5db231ea8ca18bf65228aa93
- MD5 1855fad4cfc45f67cf37f5e90e262f53
- SHA1 d9daff05c457acee0df7ca7675fe2ea5894eaf49
- SHA512 b02b2d72906295b63ae8fe9c8547253becd525e77bc048ecf53d0416dfd8134e415e8dbef773c14949109d4af2e8927978309c1a81c9fa35e59d12b7f65a12a7
- TLSH T18B1100409570F5B2CC2882ABC9917B438AE8782380C919107DA06F184DFB51E9767B07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
- Size 6KB
- SHA256 a4bce7571a1420c143c49ecca92fd01a59dae54e9e0dd2d55384b4ea02e6dfa3
- MD5 9b0956fdd210cad7fcb58e6e0452d479
- SHA1 05710de8e99130ac8514c30fdc726f5e5767687a
- SHA512 90c026615049197c51bef52fe57ddc00090514dfaa6885bcb17215066ccc73fd795da11d123d74db02a9ae82205ab4e32869250f2e52cb242f11dcc30afc5406
- SSDEEP 96:xHBUTU1LqGqTfQdM1zSJmSSlvdv9j7n0H2BoRHHBw88u8L4cnUsF:bsRTfQdMsmSSA2BoRBw88H
- TLSH T1C7E11F7891088B6F74B677ACAC648C316AB2413BBBBF68C710B558C5055CF3441F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
- Size 6KB
- SHA256 c66fa3bf6f8f648fa8561dad1fcb14ab3e98acba3b9162fe3c14055388c6aa67
- MD5 2b0d0b3ba2f20e68717fbce27ec4bb5b
- SHA1 1543656ba4cec36cf535a81c1cfdbc89052233a9
- SHA512 a642db77e2e3361c347c45ff3658bd9456d8880d9f72698057d22897337d39dc003976c2098da3a769c3f273617de3cc5533f7ebd3993cb452c3eb2ae8fa90f9
- SSDEEP 96:xHBUTU1LqGqTfQ34K1zSqSSlvdv9jYIn0H2BoRHHBw88u8L4cnUsF:bsRTfQ3NnSSCh2BoRBw88H
- TLSH T178E10E789108CB6F64B677ACAC688C315AB2413BBBBF68C710B554C5015CF3842F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SteamBooster.lnk
- Size 2KB
- SHA256 58c46d8b1f7eba0312857e024cab49f3c3b34754ea33cb7d5e6960b9bf5384a7
- MD5 075526302a04e6418bd944b8307ccfc8
- SHA1 6e26451047f1c32147121c91914aff6441fc3c7f
- SHA512 5fe8ff45f8abf9e47bbab222b36aabdb3465d32270b465d1b4e4e532faff76d29713d2f055124c54cbcbb9939526e24efaa3b9e3c04aa78fb5c9b8745e502a2f
- TLSH T11C41682156FC19A1E37BDCB965B3619ADA74B8707F0BC91D0388918C0D71E60BE66B0B
- MD5 SHA1 SHA512 TLSH