Analysis

  • max time kernel
    151s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18/02/2024, 23:05

General

  • Target

    GearUP-1.30.1-win.exe

  • Size

    57.3MB

  • MD5

    4e421aea954d50a854bb512a116134b0

  • SHA1

    53a57bb72fe1403d0a005b62856523d847fdd9f1

  • SHA256

    be3d20ba8697f4ad5ea0882ddaf9e054408c9231fbf3414d654a6a880d0362c3

  • SHA512

    d6f9c1bf998e41403291af150a9380e0136d5d04cd8d2af7c1cc3ecc4a733f4f4a482b555c1a1d6ebe68349f726de3afc4fd5e5db300a3b01f2bc03c2e7348a8

  • SSDEEP

    1572864:nERNIrTzIzaE7NqGusN6QFiVA0KZGQJLHuRtq+7r:c2TkaAk15QoSN9Yq+H

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GearUP-1.30.1-win.exe
    "C:\Users\Admin\AppData\Local\Temp\GearUP-1.30.1-win.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe
      "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUPBooster\" -aoa
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2736
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\"
      2⤵
        PID:2572
      • C:\Program Files (x86)\GearUPBooster\launcher.exe
        "C:\Program Files (x86)\GearUPBooster\launcher.exe" /install_shortcut 1 /install_autorun 0
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe
          "C:\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe" /install_shortcut 1 /install_autorun 0
          3⤵
          • Writes to the Master Boot Record (MBR)
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Program Files (x86)\GearUPBooster\9140\crashpad_handler.exe
            "C:\Program Files (x86)\GearUPBooster\9140\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\e664801d-baf5-4cf4-4882-63cea48615ed.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\e664801d-baf5-4cf4-4882-63cea48615ed.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\e664801d-baf5-4cf4-4882-63cea48615ed.run\__sentry-breadcrumb2 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x74375160,0x74375174,0x74375184
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2464
          • C:\Program Files (x86)\GearUPBooster\9140\gearup_booster_ball.exe
            C:\Program Files (x86)\GearUPBooster\9140\gearup_booster_ball.exe /main_form_wnd 524554 /show_flag 0 /pos_x -1 /pos_y -1 /version 9140 /client_id 65d28d7e7cc8470524bb2fcc /gray 0
            4⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2992
          • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe
            "C:\Program Files (x86)\GearUPBooster\9140\..\cef\3.0.0\gearup_booster_render.exe" --type=renderer --force-device-scale-factor=1 --no-sandbox --disable-databases --primordial-pipe-token=2C8C39A04B0599A672893BEAC2154C0A --lang=en-US --lang=en --log-file="C:\Program Files (x86)\GearUPBooster\9140\debug.log" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --mojo-application-channel-token=2C8C39A04B0599A672893BEAC2154C0A --channel="1520.0.654787489\175725144" --mojo-platform-channel-handle=2760 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:860

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\GearUPBooster\9140\MSVCP140.dll

      Filesize

      432KB

      MD5

      a6b18a2772631cdd06f95b19d66d2d4f

      SHA1

      c342250efab725f643e598f49d1710c74f78d022

      SHA256

      76cc277b564e69e35a0d9c440f013a52b5d25f43ba42fd0099d6fc1f05a6ce16

      SHA512

      f98e07c1b92ecfc662021e33486b660942de390b8e947126f304adee911da0574d6cac416748f6f03e6cce981737eb694fb3d2bcd80e1e207eba91a44b5f23e5

    • C:\Program Files (x86)\GearUPBooster\9140\VCRUNTIME140.dll

      Filesize

      88KB

      MD5

      81b11024a8ed0c9adfd5fbf6916b133c

      SHA1

      c87f446d9655ba2f6fddd33014c75dc783941c33

      SHA256

      eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829

      SHA512

      e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1

    • C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-stdio-l1-1-0.dll

      Filesize

      24KB

      MD5

      32d7b95b1bce23db9fbd0578053ba87f

      SHA1

      7e14a34ac667a087f66d576c65cd6fe6c1dfdd34

      SHA256

      104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728

      SHA512

      7dad74a0e3820a8237bab48f4962fe43e5b60b00f003a5de563b4cf61ee206353c9689a639566dc009f41585b54b915ff04f014230f0f38416020e08c8a44cb4

    • C:\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe

      Filesize

      2.7MB

      MD5

      6949266209393c8abf8463bafc28739b

      SHA1

      239740598842be2021672295b93e9af08f186f91

      SHA256

      691ff6a5519a9b73b9fb05199af7abd30e00d6abe6b0b1f03efb26df49fc46d2

      SHA512

      9a8ac4c8855bb3788906f04190e53e8b982d4d7026d1236a8761ea5b2de04ae72b29e9919f1656b76813990ce64e1fd113fdbd67fd308e31f5c64e46178d7e91

    • C:\Program Files (x86)\GearUPBooster\9140\gearup_booster_vpn.dll

      Filesize

      33KB

      MD5

      75d87c0b3ef67a38f86027d30c9c4020

      SHA1

      8de53cacb8db6c24b857df8e3bbcd656437f7bd9

      SHA256

      3d26877bcb6b09b4c3029d1936cfd945818abc50a493aeecc7684894dee0e06c

      SHA512

      a033974d62e8ec7880bc1d7f2c7300528acf156486c45c1675e792631f6d7b3679db3f7d4dc97eb891546d6729fc04cbbd15508ae2b1e22129f6864d61f73df4

    • C:\Program Files (x86)\GearUPBooster\9140\hostfp\64\hostpacket.sys

      Filesize

      37KB

      MD5

      5ac815ad2f4386140fe4c7eef3b06233

      SHA1

      6dd0e26f3c447602109253a7eaad59064c4162ca

      SHA256

      08d86eae497df069ef9e6525e9513a019ff7a9971780c1987fde858d51f4ed66

      SHA512

      98cf60aceabadc078e00ad1e274028714f7bbf3c86f0522ab423d50231156a2513e8cc1946b242c64af7287648e6d4ba5e630824b4d83134c471689db42fbbf5

    • C:\Program Files (x86)\GearUPBooster\9140\ping.dll

      Filesize

      685KB

      MD5

      f6efaaba556579f9557448bee193acd1

      SHA1

      edc05fa6797fc9bfadd845b1f2e498e05987610f

      SHA256

      3e3cc723108e9ab1e21c928f78943a6018c5d6a83293f114a361b3d613de0820

      SHA512

      439e88f4492c58ce21954d9990d9ea5252868b995f11c192dbf6438051b4aca9b1269eaef455170025365e5e3325fad8a8a1d4b225feacb48e257f339452be95

    • C:\Program Files (x86)\GearUPBooster\9140\skin.dll

      Filesize

      448KB

      MD5

      7e73ef31f839e971adff8f422fa714d5

      SHA1

      14c62acf009352b0418597f37e56abc4796e567b

      SHA256

      0daa195910adc51c9693edef5231935f4a85423517921db75c812611f6c262c3

      SHA512

      dad3aaf43d01fd6b67970096a6612752730c5d13407b8c33b5e18420fd0c746aba174327e7f6d316eca7760b6f394a082d4c6c88b7d8e489b1184a5c07ea963f

    • C:\Program Files (x86)\GearUPBooster\9140\ucrtbase.DLL

      Filesize

      879KB

      MD5

      3e0303f978818e5c944f5485792696fd

      SHA1

      3b6e3ea9f5a6bbdeda20d68b84e4b51dc48deb1d

      SHA256

      7041885b2a8300bf12a46510228ce8d103d74e83b1baf696b84ff3e5ab785dd1

      SHA512

      c2874029bd269e6b9f7000c48d0710c52664c44e91c3086df366c3456b8bce0ed4d7e5bcfe4bdd3d03b11b8245c65f4b848b6dc58e6ea7b1de9b3ca2fb3348bc

    • C:\Program Files (x86)\GearUPBooster\9140\ui.dll

      Filesize

      832KB

      MD5

      350f60675df161c6d034a9bae3bfaa60

      SHA1

      f5afb7db28e8a93ca8372036c8a70164d614fdcb

      SHA256

      09814034d8666788187ea0fe526e4b484bb726b0ae17a3141c431bdeefe98c98

      SHA512

      2dc6dfdffa138e6ca15891d91e04d5e50c34257ae14497534f7bd2185742da11ceac934ae98402d95a8c64753e5338afe7bb20bb545b895bc22d73985fec655a

    • C:\Program Files (x86)\GearUPBooster\9140\uninstall.exe

      Filesize

      128KB

      MD5

      947943d1aacc7d1edeb0b3514dd87f79

      SHA1

      e84ad201b0cb603cf51ed9303d5461ec02f05be4

      SHA256

      4f5b52f1c854dea87345fa3adb3fb973c0c4c3128d1cf626e1ec7096c14a2293

      SHA512

      da1d443a6b119ac1f3f2381b29ca8258a36f33ff6a0bd9b00de3dc4c0dc1e435bf06b5269b96187f5ee344ed4ff12e214026026d862d2975864c2d8c3f5c056f

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe

      Filesize

      1009KB

      MD5

      561e2e81dc8a2abc5c648cdf5b407099

      SHA1

      1ac32fc3858032aa6d3c37b4ef8f2b92fe585e2d

      SHA256

      271dae8bcb2d3f40ab65c3feeed49b9ae2cdd91bfe16230971289e28570c9a7f

      SHA512

      2601e48ad443b98f8b207265eb8e46e6889c4d656e0f677b4f4d7cbc4fc1b1b031189e382f4d118eef6f4b54cb2d16a8179d2184cd8580d8b928b847a46315a8

    • C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\gearup_booster.zip

      Filesize

      2.1MB

      MD5

      61460c2add30c90849a70d93bbb4948e

      SHA1

      8b2ab966a8b75835e87e9d72c79dac71acd14eb4

      SHA256

      b5ab1a4599cfff4b97c713c833b88e1c87dfb87ac5594b2b3f9e66a684e8307c

      SHA512

      fb9a35606f2d04a021b9212a4fd69360232581211f35c98eae0e54723c10ab63ad9e7944b789fb95a500f3f17cf72fbf350296f6c3eb64a3b9471c23f412ad5e

    • C:\Program Files (x86)\GearUPBooster\launcher.exe

      Filesize

      648KB

      MD5

      d38876b613520a9d6c298ba740febea0

      SHA1

      06eb99858a0730c7a6b737f42962ecb2b945cb16

      SHA256

      0a015f5d024258b46c714ee9dae77f0f9529ff18f5b0721267f74a7d51b6b45d

      SHA512

      a4335642b3c99900b56863bfec64e6793a9501d0da94fd271f8c92c2ee0ebafa59aeef53a412c261d7f955cf21830949a97efc52f05e558b0d95bcfa235575de

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP Booster.lnk

      Filesize

      1017B

      MD5

      ff4c47ec197e9a3b30695f804dc4102e

      SHA1

      8c348a3de7b0d27f95ddc9dbcf16541923518874

      SHA256

      5d7267d2d6c0234305fbd750390e7463f5892b6a6e27485d486e240ec9b5ad2b

      SHA512

      5586cdedd380dbae5f5f8fc293310d6dc0b4ce0107190931b5f78f1b366c4cf5ed6953cd0a8796078544a6f40134ed52c908eafa99f213ed043bc5dabda75347

    • C:\Users\Admin\AppData\Local\Temp\Cab19F8.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar1A3A.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-core-file-l1-2-0.dll

      Filesize

      18KB

      MD5

      f6d1216e974fb76585fd350ebdc30648

      SHA1

      f8f73aa038e49d9fcf3bd05a30dc2e8cbbe54a7c

      SHA256

      348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271

      SHA512

      756ee21ba895179a5b6836b75aeefb75389b0fe4ae2aaff9ed84f33075094663117133c810ab2e697ec04eaffd54ff03efa3b9344e467a847acea9f732935843

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-core-file-l2-1-0.dll

      Filesize

      18KB

      MD5

      bfb08fb09e8d68673f2f0213c59e2b97

      SHA1

      e1e5ff4e7dd1c902afbe195d3e9fd2a7d4a539f2

      SHA256

      6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e

      SHA512

      e4f33306f3d06ea5c8e539ebdb6926d5f818234f481ff4605a9d5698ae8f2afdf79f194acd0e55ac963383b78bb4c9311ee97f3a188e12fbf2ee13b35d409900

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-core-localization-l1-2-0.dll

      Filesize

      20KB

      MD5

      3b9d034ca8a0345bc8f248927a86bf22

      SHA1

      95faf5007daf8ba712a5d17f865f0e7938da662b

      SHA256

      a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d

      SHA512

      04f0830878e0166ffd1220536592d0d7ec8aacd3f04340a8d91df24d728f34fbbd559432e5c35f256d231afe0ae926139d7503107cea09bfd720ad65e19d1cdc

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-core-processthreads-l1-1-1.dll

      Filesize

      18KB

      MD5

      c2ead5fcce95a04d31810768a3d44d57

      SHA1

      96e791b4d217b3612b0263e8df2f00009d5af8d8

      SHA256

      42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62

      SHA512

      c90048481d8f0a5eda2eb6e7703b5a064f481bb7d8c78970408b374cb82e89febc2e36633f1f3e28323fb633d6a95aa1050a626cb0cb5ec62e9010491aae91f4

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-core-synch-l1-2-0.dll

      Filesize

      18KB

      MD5

      f6b4d8d403d22eb87a60bf6e4a3e7041

      SHA1

      b51a63f258b57527549d5331c405eacc77969433

      SHA256

      25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270

      SHA512

      1acd8f7bc5d3ae1db46824b3a5548b33e56c9bac81dcd2e7d90fdbd1d3dd76f93cdf4d52a5f316728f92e623f73bc2ccd0bc505a259dff20c1a5a2eb2f12e41b

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-core-timezone-l1-1-0.dll

      Filesize

      18KB

      MD5

      a20084f41b3f1c549d6625c790b72268

      SHA1

      e3669b8d89402a047bfbf9775d18438b0d95437e

      SHA256

      0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1

      SHA512

      ddf294a47dd80b3abfb3a0d82bc5f2b510d3734439f5a25da609edbbd9241ed78045114d011925d61c3d80b1ccd0283471b1dad4cf16e2194e9bc22e8abf278f

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-heap-l1-1-0.dll

      Filesize

      19KB

      MD5

      39d81596a7308e978d67ad6fdccdd331

      SHA1

      a0b2d43dd1c27d8244d11495e16d9f4f889e34c4

      SHA256

      3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7

      SHA512

      0ef6578de4e6ba55eda64691892d114e154d288c419d05d6cff0ef4240118c20a4ce7f4174eec1a33397c6cd0135d13798dc91cc97416351775f9abf60fcae76

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-runtime-l1-1-0.dll

      Filesize

      22KB

      MD5

      ae3fa6bf777b0429b825fb6b028f8a48

      SHA1

      b53dbfdb7c8deaa9a05381f5ac2e596830039838

      SHA256

      66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb

      SHA512

      1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece

    • \Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-string-l1-1-0.dll

      Filesize

      24KB

      MD5

      5e72659b38a2977984bbc23ed274f007

      SHA1

      ea622d608cc942bdb0fad118c8060b60b2e985c9

      SHA256

      44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea

      SHA512

      ed3cb656a5f5aee2cc04dd1f25b1390d52f3e85f0c7742ed0d473a117d2ac49e225a0cb324c31747d221617abcd6a9200c16dd840284bb29155726a3aa749bb1

    • \Program Files (x86)\GearUPBooster\9140\gearup_booster.exe

      Filesize

      7.4MB

      MD5

      44dc221f00813d6d75264a4e195b54e1

      SHA1

      151e17d85e9d110f317f7d157df93eeb06da14aa

      SHA256

      12dcc4bf69ea1fc69fd35be315189e8d2084359a9f099a03c3407d35754cb0db

      SHA512

      79ac2612f7a71b9c853b0d9726a583010cb449e8ad5c4a0ec5561324d85ef03626d94cfbe54085ccff8eae9ae4fc905422415e1532643948ea3a9de8a84649a8

    • \Program Files (x86)\GearUPBooster\9140\gearup_booster_ball.exe

      Filesize

      1.4MB

      MD5

      f356476d26ce1b2c5f03e2a194467e35

      SHA1

      08bf158465e3f883103d4c8081cf4d1f718193f7

      SHA256

      3cf5dc6f78f24b9fe92c7d9255d78b03e52e6fc6e3920dc71a5882c1c94901d2

      SHA512

      ec2eef8b30b11cc684f3145de18469bbc3baac2844f1211dd065c0ee3f7e608b1414f97a3bfe5d236560543a1e7b8aaff55efbbe6b03ebf12226966c87e19ff0

    • \Program Files (x86)\GearUPBooster\9140\ping.dll

      Filesize

      128KB

      MD5

      dfa08c5c282d7b21ff5f11a9297252bf

      SHA1

      5d5fc1fd17e3f5f0a831166b566e03aed0b40879

      SHA256

      41a6fd08b95ecd7b40c458fb6ed87bd3da80e7a70bb9c2c7ed965da2bc2b51d7

      SHA512

      3b898ecb8942d4ad962f0cbc0a7e92cc07993168b6271353bc6d698c74cbc6900809907a5ee9acea26c3b4da7da25e3e258c7558ca68c2ce4cc289dba79ebe2b

    • \Program Files (x86)\GearUPBooster\9140\sentry.dll

      Filesize

      426KB

      MD5

      bf9002bf5c878cdca749025a5f875d6b

      SHA1

      e916d3121706dbd1ada335b414e4601373b86ef8

      SHA256

      4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05

      SHA512

      34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20

    • \Program Files (x86)\GearUPBooster\9140\skin.dll

      Filesize

      128KB

      MD5

      88d7e7c34e3a5f9e32b1f86f30f609b3

      SHA1

      7668d36118a8648548f9b469e0566870c75caafd

      SHA256

      8bc0833a3baf426e66daca0b50476c2caca5259e8fb4302c1b2d8e1b9777a4dd

      SHA512

      a8a68f89be0a0ae3164bceb64732e0db48e6143319e673416f2857e44d6f2b4eb77fd9508ef119a7865fd412dc0a7cbfdf3afefc5faf31177e9ac92782949852

    • \Program Files (x86)\GearUPBooster\9140\ui.dll

      Filesize

      553KB

      MD5

      d7da5785ebb765b0cf6e9a03b016f53b

      SHA1

      840a193b3b1ff44e01f5c943e1c004b7a5117c1b

      SHA256

      4db1ea5bb02a87c8cdbddd8385934306f1c5af645012a3ae1354e31b23c2f681

      SHA512

      787ad4fa19082bd4ebb2820a62b377eaafc8735010a5ec543fb09c79df79d8e020522fbee41852026056e29c6990c931764b444e05bfe68ea66605298bc0a634

    • \Program Files (x86)\GearUPBooster\9140\ui.dll

      Filesize

      512KB

      MD5

      20c592976bcfdd0a9a6748c69d0ae6a9

      SHA1

      7b1b0c5f2396f15bbc90435bea96654edb2f3284

      SHA256

      3d03158e0440a4bcde9eda49c124f5c2743edeb50a96d983d2de0fee5f4f7bbd

      SHA512

      df4bf23cb725a0cf07ce54832e5b11e7ec659e878933422e23be60f785e718531a1d46389820780a97ae578f1c3359359c3ad15d36af3293f1b134565570b765

    • \Program Files (x86)\GearUPBooster\9140\update.exe

      Filesize

      2.2MB

      MD5

      855d1c030749ec39c73e67308c39a3a8

      SHA1

      2768fb250d817560671b7fba9e91c9f3571c16ac

      SHA256

      4079e2ebd33c681d9220a88c3c56c9494d48303798e8c66744de17d062cd9b49

      SHA512

      0dc5d3ddf83c1997997cc25d40ca1052b1683af21bc3aad85735fcc165d6021b3e2b15adb21bf68a4bd8ea6113590685ddad2b891aa67b2dd8a305139e6cfb8a

    • \Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe

      Filesize

      589KB

      MD5

      c6d72642721e84d227defc3ec4ab12e6

      SHA1

      3709a7c3cc795a0012adc6ccaf82a93628703518

      SHA256

      0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035

      SHA512

      fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389

    • \Program Files (x86)\GearUPBooster\launcher.exe

      Filesize

      921KB

      MD5

      346efb7dffcd59aaf4835c82a350ea0d

      SHA1

      e15e2b76ae1471ecba7b6ba47106a2ecdb5e6528

      SHA256

      806cf3a37419355c7d24bb362fae43700f8d4d1c017ff9aa4bdde75663fcc719

      SHA512

      3cc316303ae44c7e0b7ee2f5a9b794fa843bd5e827a005f1dda8f97a7c0e79c5fae9968769ed8aea54a6c8dd5e0295c888c8becdbd9cf238f74f549e79d4f6f2

    • \Program Files (x86)\GearUPBooster\launcher.exe

      Filesize

      832KB

      MD5

      0c4c3247776a1763d8c43558025232c6

      SHA1

      4c7e150142b7f2f9ca39bd7494eca8dc21c6f954

      SHA256

      b61411e4be19f8f8b91f1e841c8dcfebedbfdfe71f38d8ebbcbe991b01517227

      SHA512

      854122ffa0667b0301db2e8e45be17600527ff69107b02bd5638ceaaf9189cc87e4d0ce45d54e8a220e0dc572d97bde1ac3b2f91890534f7527b4c873eae9fa5

    • memory/860-426-0x0000000017900000-0x0000000017901000-memory.dmp

      Filesize

      4KB