be3d20ba8697f4ad5ea0882ddaf9e054408c9231fbf3414d654a6a880d0362c3

Analysis

max time kernel
151s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GearUP-1.30.1-win.exe
Size

57.3MB
MD5

4e421aea954d50a854bb512a116134b0
SHA1

53a57bb72fe1403d0a005b62856523d847fdd9f1
SHA256

be3d20ba8697f4ad5ea0882ddaf9e054408c9231fbf3414d654a6a880d0362c3
SHA512

d6f9c1bf998e41403291af150a9380e0136d5d04cd8d2af7c1cc3ecc4a733f4f4a482b555c1a1d6ebe68349f726de3afc4fd5e5db300a3b01f2bc03c2e7348a8
SSDEEP

1572864:nERNIrTzIzaE7NqGusN6QFiVA0KZGQJLHuRtq+7r:c2TkaAk15QoSN9Yq+H

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\hostpacket.sys	GearUP-1.30.1-win.exe
File opened for modification	C:\Windows\System32\drivers\hostpacket.sys	GearUP-1.30.1-win.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\sentry.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\wfp\win\x64	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\bn.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\ta.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\th.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\tr.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-convert-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\msvcp140.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\cs.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\ru.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\launcher.VisualElementsManifest.xml	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\arm64\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\7za.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\x64\NW_TAP_0909.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\widevinecdmadapter.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\bn.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\arm64\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\update.exe	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-stdio-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\lsp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\ngpush.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\i386\nw_tap_0909.cat	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\host_fp.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\vcruntime140.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\x64\NW_TAP_0921.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\arm64\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\i386\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\es-419.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-multibyte-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\host_dp.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\local_proxy.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tun2proxy.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\udp_connect_lsp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\x64\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\de.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\hu.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\i386\OemVista.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\ucrtbase.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\wfp\win\x32\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\en-GB.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\fil.pak	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\VisualElements\SmallLogo.png	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\x64\tap0901.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-locale-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\d3dcompiler_47.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\x64\NW_TAP_0921.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\ar.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\i386\nw_tap_0921.cat	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\tap_driver\x64\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\uninstall.exe	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-filesystem-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\ui.dll	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\wfp\arm64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\sw.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-utility-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\wfp\win\x64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\pt-PT.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\sr.pak	7za.exe
File created	C:\Program Files (x86)\GearUPBooster\9140\ui.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUPBooster\9140\ws2detour_x64.dll	7za.exe

Executes dropped EXE 6 IoCs

pid	Process
2736	7za.exe
2644	launcher.exe
1520	gearup_booster.exe
2464	crashpad_handler.exe
2992	gearup_booster_ball.exe
860	gearup_booster_render.exe

Loads dropped DLL 64 IoCs

pid	Process
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2984	GearUP-1.30.1-win.exe
2644	launcher.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
1520	gearup_booster.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe
2464	crashpad_handler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	GearUP-1.30.1-win.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUPBooster\\9140\\gearup_booster.exe \"%1\""	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1520	gearup_booster.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2736	7za.exe
Token: 35	2736	7za.exe
Token: SeSecurityPrivilege	2736	7za.exe
Token: SeSecurityPrivilege	2736	7za.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2984	GearUP-1.30.1-win.exe
2992	gearup_booster_ball.exe
1520	gearup_booster.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2992	gearup_booster_ball.exe
1520	gearup_booster.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2736	2984	GearUP-1.30.1-win.exe	28
PID 2984 wrote to memory of 2736	2984	GearUP-1.30.1-win.exe	28
PID 2984 wrote to memory of 2736	2984	GearUP-1.30.1-win.exe	28
PID 2984 wrote to memory of 2736	2984	GearUP-1.30.1-win.exe	28
PID 2984 wrote to memory of 2572	2984	GearUP-1.30.1-win.exe	33
PID 2984 wrote to memory of 2572	2984	GearUP-1.30.1-win.exe	33
PID 2984 wrote to memory of 2572	2984	GearUP-1.30.1-win.exe	33
PID 2984 wrote to memory of 2572	2984	GearUP-1.30.1-win.exe	33
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2984 wrote to memory of 2644	2984	GearUP-1.30.1-win.exe	35
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 2644 wrote to memory of 1520	2644	launcher.exe	36
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2464	1520	gearup_booster.exe	37
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 2992	1520	gearup_booster.exe	39
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40
PID 1520 wrote to memory of 860	1520	gearup_booster.exe	40

C:\Users\Admin\AppData\Local\Temp\GearUP-1.30.1-win.exe
"C:\Users\Admin\AppData\Local\Temp\GearUP-1.30.1-win.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe
  "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUPBooster\" -aoa
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\"
  2⤵
  PID:2572
- C:\Program Files (x86)\GearUPBooster\launcher.exe
  "C:\Program Files (x86)\GearUPBooster\launcher.exe" /install_shortcut 1 /install_autorun 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe
    "C:\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe" /install_shortcut 1 /install_autorun 0
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Program Files (x86)\GearUPBooster\9140\crashpad_handler.exe
      "C:\Program Files (x86)\GearUPBooster\9140\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\e664801d-baf5-4cf4-4882-63cea48615ed.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\e664801d-baf5-4cf4-4882-63cea48615ed.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\e664801d-baf5-4cf4-4882-63cea48615ed.run\__sentry-breadcrumb2 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x74375160,0x74375174,0x74375184
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2464
  - - C:\Program Files (x86)\GearUPBooster\9140\gearup_booster_ball.exe
      C:\Program Files (x86)\GearUPBooster\9140\gearup_booster_ball.exe /main_form_wnd 524554 /show_flag 0 /pos_x -1 /pos_y -1 /version 9140 /client_id 65d28d7e7cc8470524bb2fcc /gray 0
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2992
  - - C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe
      "C:\Program Files (x86)\GearUPBooster\9140\..\cef\3.0.0\gearup_booster_render.exe" --type=renderer --force-device-scale-factor=1 --no-sandbox --disable-databases --primordial-pipe-token=2C8C39A04B0599A672893BEAC2154C0A --lang=en-US --lang=en --log-file="C:\Program Files (x86)\GearUPBooster\9140\debug.log" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --mojo-application-channel-token=2C8C39A04B0599A672893BEAC2154C0A --channel="1520.0.654787489\175725144" --mojo-platform-channel-handle=2760 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GearUPBooster\9140\MSVCP140.dll

Filesize
432KB

MD5
a6b18a2772631cdd06f95b19d66d2d4f

SHA1
c342250efab725f643e598f49d1710c74f78d022

SHA256
76cc277b564e69e35a0d9c440f013a52b5d25f43ba42fd0099d6fc1f05a6ce16

SHA512
f98e07c1b92ecfc662021e33486b660942de390b8e947126f304adee911da0574d6cac416748f6f03e6cce981737eb694fb3d2bcd80e1e207eba91a44b5f23e5

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\VCRUNTIME140.dll

Filesize
88KB

MD5
81b11024a8ed0c9adfd5fbf6916b133c

SHA1
c87f446d9655ba2f6fddd33014c75dc783941c33

SHA256
eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829

SHA512
e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
32d7b95b1bce23db9fbd0578053ba87f

SHA1
7e14a34ac667a087f66d576c65cd6fe6c1dfdd34

SHA256
104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728

SHA512
7dad74a0e3820a8237bab48f4962fe43e5b60b00f003a5de563b4cf61ee206353c9689a639566dc009f41585b54b915ff04f014230f0f38416020e08c8a44cb4

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe

Filesize
2.7MB

MD5
6949266209393c8abf8463bafc28739b

SHA1
239740598842be2021672295b93e9af08f186f91

SHA256
691ff6a5519a9b73b9fb05199af7abd30e00d6abe6b0b1f03efb26df49fc46d2

SHA512
9a8ac4c8855bb3788906f04190e53e8b982d4d7026d1236a8761ea5b2de04ae72b29e9919f1656b76813990ce64e1fd113fdbd67fd308e31f5c64e46178d7e91

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\gearup_booster_vpn.dll

Filesize
33KB

MD5
75d87c0b3ef67a38f86027d30c9c4020

SHA1
8de53cacb8db6c24b857df8e3bbcd656437f7bd9

SHA256
3d26877bcb6b09b4c3029d1936cfd945818abc50a493aeecc7684894dee0e06c

SHA512
a033974d62e8ec7880bc1d7f2c7300528acf156486c45c1675e792631f6d7b3679db3f7d4dc97eb891546d6729fc04cbbd15508ae2b1e22129f6864d61f73df4

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\hostfp\64\hostpacket.sys

Filesize
37KB

MD5
5ac815ad2f4386140fe4c7eef3b06233

SHA1
6dd0e26f3c447602109253a7eaad59064c4162ca

SHA256
08d86eae497df069ef9e6525e9513a019ff7a9971780c1987fde858d51f4ed66

SHA512
98cf60aceabadc078e00ad1e274028714f7bbf3c86f0522ab423d50231156a2513e8cc1946b242c64af7287648e6d4ba5e630824b4d83134c471689db42fbbf5

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\ping.dll

Filesize
685KB

MD5
f6efaaba556579f9557448bee193acd1

SHA1
edc05fa6797fc9bfadd845b1f2e498e05987610f

SHA256
3e3cc723108e9ab1e21c928f78943a6018c5d6a83293f114a361b3d613de0820

SHA512
439e88f4492c58ce21954d9990d9ea5252868b995f11c192dbf6438051b4aca9b1269eaef455170025365e5e3325fad8a8a1d4b225feacb48e257f339452be95

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\skin.dll

Filesize
448KB

MD5
7e73ef31f839e971adff8f422fa714d5

SHA1
14c62acf009352b0418597f37e56abc4796e567b

SHA256
0daa195910adc51c9693edef5231935f4a85423517921db75c812611f6c262c3

SHA512
dad3aaf43d01fd6b67970096a6612752730c5d13407b8c33b5e18420fd0c746aba174327e7f6d316eca7760b6f394a082d4c6c88b7d8e489b1184a5c07ea963f

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\ucrtbase.DLL

Filesize
879KB

MD5
3e0303f978818e5c944f5485792696fd

SHA1
3b6e3ea9f5a6bbdeda20d68b84e4b51dc48deb1d

SHA256
7041885b2a8300bf12a46510228ce8d103d74e83b1baf696b84ff3e5ab785dd1

SHA512
c2874029bd269e6b9f7000c48d0710c52664c44e91c3086df366c3456b8bce0ed4d7e5bcfe4bdd3d03b11b8245c65f4b848b6dc58e6ea7b1de9b3ca2fb3348bc

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\ui.dll

Filesize
832KB

MD5
350f60675df161c6d034a9bae3bfaa60

SHA1
f5afb7db28e8a93ca8372036c8a70164d614fdcb

SHA256
09814034d8666788187ea0fe526e4b484bb726b0ae17a3141c431bdeefe98c98

SHA512
2dc6dfdffa138e6ca15891d91e04d5e50c34257ae14497534f7bd2185742da11ceac934ae98402d95a8c64753e5338afe7bb20bb545b895bc22d73985fec655a

Download Submit
C:\Program Files (x86)\GearUPBooster\9140\uninstall.exe

Filesize
128KB

MD5
947943d1aacc7d1edeb0b3514dd87f79

SHA1
e84ad201b0cb603cf51ed9303d5461ec02f05be4

SHA256
4f5b52f1c854dea87345fa3adb3fb973c0c4c3128d1cf626e1ec7096c14a2293

SHA512
da1d443a6b119ac1f3f2381b29ca8258a36f33ff6a0bd9b00de3dc4c0dc1e435bf06b5269b96187f5ee344ed4ff12e214026026d862d2975864c2d8c3f5c056f

Download Submit
C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe

Filesize
1009KB

MD5
561e2e81dc8a2abc5c648cdf5b407099

SHA1
1ac32fc3858032aa6d3c37b4ef8f2b92fe585e2d

SHA256
271dae8bcb2d3f40ab65c3feeed49b9ae2cdd91bfe16230971289e28570c9a7f

SHA512
2601e48ad443b98f8b207265eb8e46e6889c4d656e0f677b4f4d7cbc4fc1b1b031189e382f4d118eef6f4b54cb2d16a8179d2184cd8580d8b928b847a46315a8

Download Submit
C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\gearup_booster.zip

Filesize
2.1MB

MD5
61460c2add30c90849a70d93bbb4948e

SHA1
8b2ab966a8b75835e87e9d72c79dac71acd14eb4

SHA256
b5ab1a4599cfff4b97c713c833b88e1c87dfb87ac5594b2b3f9e66a684e8307c

SHA512
fb9a35606f2d04a021b9212a4fd69360232581211f35c98eae0e54723c10ab63ad9e7944b789fb95a500f3f17cf72fbf350296f6c3eb64a3b9471c23f412ad5e

Download Submit
C:\Program Files (x86)\GearUPBooster\launcher.exe

Filesize
648KB

MD5
d38876b613520a9d6c298ba740febea0

SHA1
06eb99858a0730c7a6b737f42962ecb2b945cb16

SHA256
0a015f5d024258b46c714ee9dae77f0f9529ff18f5b0721267f74a7d51b6b45d

SHA512
a4335642b3c99900b56863bfec64e6793a9501d0da94fd271f8c92c2ee0ebafa59aeef53a412c261d7f955cf21830949a97efc52f05e558b0d95bcfa235575de

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP Booster.lnk

Filesize
1017B

MD5
ff4c47ec197e9a3b30695f804dc4102e

SHA1
8c348a3de7b0d27f95ddc9dbcf16541923518874

SHA256
5d7267d2d6c0234305fbd750390e7463f5892b6a6e27485d486e240ec9b5ad2b

SHA512
5586cdedd380dbae5f5f8fc293310d6dc0b4ce0107190931b5f78f1b366c4cf5ed6953cd0a8796078544a6f40134ed52c908eafa99f213ed043bc5dabda75347

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A3A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
f6d1216e974fb76585fd350ebdc30648

SHA1
f8f73aa038e49d9fcf3bd05a30dc2e8cbbe54a7c

SHA256
348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271

SHA512
756ee21ba895179a5b6836b75aeefb75389b0fe4ae2aaff9ed84f33075094663117133c810ab2e697ec04eaffd54ff03efa3b9344e467a847acea9f732935843

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfb08fb09e8d68673f2f0213c59e2b97

SHA1
e1e5ff4e7dd1c902afbe195d3e9fd2a7d4a539f2

SHA256
6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e

SHA512
e4f33306f3d06ea5c8e539ebdb6926d5f818234f481ff4605a9d5698ae8f2afdf79f194acd0e55ac963383b78bb4c9311ee97f3a188e12fbf2ee13b35d409900

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
3b9d034ca8a0345bc8f248927a86bf22

SHA1
95faf5007daf8ba712a5d17f865f0e7938da662b

SHA256
a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d

SHA512
04f0830878e0166ffd1220536592d0d7ec8aacd3f04340a8d91df24d728f34fbbd559432e5c35f256d231afe0ae926139d7503107cea09bfd720ad65e19d1cdc

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
c2ead5fcce95a04d31810768a3d44d57

SHA1
96e791b4d217b3612b0263e8df2f00009d5af8d8

SHA256
42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62

SHA512
c90048481d8f0a5eda2eb6e7703b5a064f481bb7d8c78970408b374cb82e89febc2e36633f1f3e28323fb633d6a95aa1050a626cb0cb5ec62e9010491aae91f4

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
f6b4d8d403d22eb87a60bf6e4a3e7041

SHA1
b51a63f258b57527549d5331c405eacc77969433

SHA256
25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270

SHA512
1acd8f7bc5d3ae1db46824b3a5548b33e56c9bac81dcd2e7d90fdbd1d3dd76f93cdf4d52a5f316728f92e623f73bc2ccd0bc505a259dff20c1a5a2eb2f12e41b

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
a20084f41b3f1c549d6625c790b72268

SHA1
e3669b8d89402a047bfbf9775d18438b0d95437e

SHA256
0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1

SHA512
ddf294a47dd80b3abfb3a0d82bc5f2b510d3734439f5a25da609edbbd9241ed78045114d011925d61c3d80b1ccd0283471b1dad4cf16e2194e9bc22e8abf278f

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
39d81596a7308e978d67ad6fdccdd331

SHA1
a0b2d43dd1c27d8244d11495e16d9f4f889e34c4

SHA256
3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7

SHA512
0ef6578de4e6ba55eda64691892d114e154d288c419d05d6cff0ef4240118c20a4ce7f4174eec1a33397c6cd0135d13798dc91cc97416351775f9abf60fcae76

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
ae3fa6bf777b0429b825fb6b028f8a48

SHA1
b53dbfdb7c8deaa9a05381f5ac2e596830039838

SHA256
66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb

SHA512
1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece

Download Submit
\Program Files (x86)\GearUPBooster\9140\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
5e72659b38a2977984bbc23ed274f007

SHA1
ea622d608cc942bdb0fad118c8060b60b2e985c9

SHA256
44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea

SHA512
ed3cb656a5f5aee2cc04dd1f25b1390d52f3e85f0c7742ed0d473a117d2ac49e225a0cb324c31747d221617abcd6a9200c16dd840284bb29155726a3aa749bb1

Download Submit
\Program Files (x86)\GearUPBooster\9140\gearup_booster.exe

Filesize
7.4MB

MD5
44dc221f00813d6d75264a4e195b54e1

SHA1
151e17d85e9d110f317f7d157df93eeb06da14aa

SHA256
12dcc4bf69ea1fc69fd35be315189e8d2084359a9f099a03c3407d35754cb0db

SHA512
79ac2612f7a71b9c853b0d9726a583010cb449e8ad5c4a0ec5561324d85ef03626d94cfbe54085ccff8eae9ae4fc905422415e1532643948ea3a9de8a84649a8

Download Submit
\Program Files (x86)\GearUPBooster\9140\gearup_booster_ball.exe

Filesize
1.4MB

MD5
f356476d26ce1b2c5f03e2a194467e35

SHA1
08bf158465e3f883103d4c8081cf4d1f718193f7

SHA256
3cf5dc6f78f24b9fe92c7d9255d78b03e52e6fc6e3920dc71a5882c1c94901d2

SHA512
ec2eef8b30b11cc684f3145de18469bbc3baac2844f1211dd065c0ee3f7e608b1414f97a3bfe5d236560543a1e7b8aaff55efbbe6b03ebf12226966c87e19ff0

Download Submit
\Program Files (x86)\GearUPBooster\9140\ping.dll

Filesize
128KB

MD5
dfa08c5c282d7b21ff5f11a9297252bf

SHA1
5d5fc1fd17e3f5f0a831166b566e03aed0b40879

SHA256
41a6fd08b95ecd7b40c458fb6ed87bd3da80e7a70bb9c2c7ed965da2bc2b51d7

SHA512
3b898ecb8942d4ad962f0cbc0a7e92cc07993168b6271353bc6d698c74cbc6900809907a5ee9acea26c3b4da7da25e3e258c7558ca68c2ce4cc289dba79ebe2b

Download Submit
\Program Files (x86)\GearUPBooster\9140\sentry.dll

Filesize
426KB

MD5
bf9002bf5c878cdca749025a5f875d6b

SHA1
e916d3121706dbd1ada335b414e4601373b86ef8

SHA256
4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05

SHA512
34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20

Download Submit
\Program Files (x86)\GearUPBooster\9140\skin.dll

Filesize
128KB

MD5
88d7e7c34e3a5f9e32b1f86f30f609b3

SHA1
7668d36118a8648548f9b469e0566870c75caafd

SHA256
8bc0833a3baf426e66daca0b50476c2caca5259e8fb4302c1b2d8e1b9777a4dd

SHA512
a8a68f89be0a0ae3164bceb64732e0db48e6143319e673416f2857e44d6f2b4eb77fd9508ef119a7865fd412dc0a7cbfdf3afefc5faf31177e9ac92782949852

Download Submit
\Program Files (x86)\GearUPBooster\9140\ui.dll

Filesize
553KB

MD5
d7da5785ebb765b0cf6e9a03b016f53b

SHA1
840a193b3b1ff44e01f5c943e1c004b7a5117c1b

SHA256
4db1ea5bb02a87c8cdbddd8385934306f1c5af645012a3ae1354e31b23c2f681

SHA512
787ad4fa19082bd4ebb2820a62b377eaafc8735010a5ec543fb09c79df79d8e020522fbee41852026056e29c6990c931764b444e05bfe68ea66605298bc0a634

Download Submit
\Program Files (x86)\GearUPBooster\9140\ui.dll

Filesize
512KB

MD5
20c592976bcfdd0a9a6748c69d0ae6a9

SHA1
7b1b0c5f2396f15bbc90435bea96654edb2f3284

SHA256
3d03158e0440a4bcde9eda49c124f5c2743edeb50a96d983d2de0fee5f4f7bbd

SHA512
df4bf23cb725a0cf07ce54832e5b11e7ec659e878933422e23be60f785e718531a1d46389820780a97ae578f1c3359359c3ad15d36af3293f1b134565570b765

Download Submit
\Program Files (x86)\GearUPBooster\9140\update.exe

Filesize
2.2MB

MD5
855d1c030749ec39c73e67308c39a3a8

SHA1
2768fb250d817560671b7fba9e91c9f3571c16ac

SHA256
4079e2ebd33c681d9220a88c3c56c9494d48303798e8c66744de17d062cd9b49

SHA512
0dc5d3ddf83c1997997cc25d40ca1052b1683af21bc3aad85735fcc165d6021b3e2b15adb21bf68a4bd8ea6113590685ddad2b891aa67b2dd8a305139e6cfb8a

Download Submit
\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe

Filesize
589KB

MD5
c6d72642721e84d227defc3ec4ab12e6

SHA1
3709a7c3cc795a0012adc6ccaf82a93628703518

SHA256
0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035

SHA512
fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389

Download Submit
\Program Files (x86)\GearUPBooster\launcher.exe

Filesize
921KB

MD5
346efb7dffcd59aaf4835c82a350ea0d

SHA1
e15e2b76ae1471ecba7b6ba47106a2ecdb5e6528

SHA256
806cf3a37419355c7d24bb362fae43700f8d4d1c017ff9aa4bdde75663fcc719

SHA512
3cc316303ae44c7e0b7ee2f5a9b794fa843bd5e827a005f1dda8f97a7c0e79c5fae9968769ed8aea54a6c8dd5e0295c888c8becdbd9cf238f74f549e79d4f6f2

Download Submit
\Program Files (x86)\GearUPBooster\launcher.exe

Filesize
832KB

MD5
0c4c3247776a1763d8c43558025232c6

SHA1
4c7e150142b7f2f9ca39bd7494eca8dc21c6f954

SHA256
b61411e4be19f8f8b91f1e841c8dcfebedbfdfe71f38d8ebbcbe991b01517227

SHA512
854122ffa0667b0301db2e8e45be17600527ff69107b02bd5638ceaaf9189cc87e4d0ce45d54e8a220e0dc572d97bde1ac3b2f91890534f7527b4c873eae9fa5

Download Submit
memory/860-426-0x0000000017900000-0x0000000017901000-memory.dmp

Filesize
4KB

Download