Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 07:31

General

  • Target

    GearUP-2.4.3-win.exe

  • Size

    57.3MB

  • MD5

    2076c784654c2b22c3d9355fc3697811

  • SHA1

    10924c99acb8f1e82836d1598ff93db9c8fe3925

  • SHA256

    a904b59f6b25093132b1b38979ac696d5c488230da1ee7155fb763e592a06df7

  • SHA512

    e6cc266c808f507f584fd8ca2ce0a9656611152e266456c6a3c93c74fd06d23070e6ab13587e0944353b40a85cf6d8e0f6810d647e19d4c3245a9b76be713cc0

  • SSDEEP

    1572864:fEwNwV4ly4q9tYAUGvki1JrIiYgxVEGpQXK5kX8xpLIl:hCptYAGimgxGupA

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GearUP-2.4.3-win.exe
    "C:\Users\Admin\AppData\Local\Temp\GearUP-2.4.3-win.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe
      "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUPBooster\" -aoa
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4740
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\"
      2⤵
        PID:2100
      • C:\Program Files (x86)\GearUPBooster\launcher.exe
        "C:\Program Files (x86)\GearUPBooster\launcher.exe" /install_shortcut 1 /install_autorun 0
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:232
        • C:\Program Files (x86)\GearUPBooster\9155\gearup_booster.exe
          "C:\Program Files (x86)\GearUPBooster\9155\gearup_booster.exe" /install_shortcut 1 /install_autorun 0
          3⤵
          • Writes to the Master Boot Record (MBR)
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Program Files (x86)\GearUPBooster\9155\crashpad_handler.exe
            "C:\Program Files (x86)\GearUPBooster\9155\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\9974e0dd-69ca-4231-5541-7439515c983d.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\9974e0dd-69ca-4231-5541-7439515c983d.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\9974e0dd-69ca-4231-5541-7439515c983d.run\__sentry-breadcrumb2 --initial-client-data=0x498,0x49c,0x4a0,0x474,0x4a4,0x74085160,0x74085174,0x74085184
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1952
          • C:\Program Files (x86)\GearUPBooster\9155\gearup_booster_ball.exe
            C:\Program Files (x86)\GearUPBooster\9155\gearup_booster_ball.exe /main_form_wnd 590310 /show_flag 0 /pos_x -1 /pos_y -1 /version 9155 /client_id 6684fea5555ecf088810650b /gray 0
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3140
          • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\gearup_booster_render.exe
            "C:\Program Files (x86)\GearUPBooster\9155\..\cef\3.0.0\gearup_booster_render.exe" --type=renderer --force-device-scale-factor=1 --no-sandbox --primordial-pipe-token=1DDDF71941C445586E18E81E1E2A9806 --lang=en-US --lang=en --log-file="C:\Program Files (x86)\GearUPBooster\9155\debug.log" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --mojo-application-channel-token=1DDDF71941C445586E18E81E1E2A9806 --channel="552.0.223819671\904213412" --mojo-platform-channel-handle=3892 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\GearUPBooster\9155\MSVCR100.dll

      Filesize

      755KB

      MD5

      0e37fbfa79d349d672456923ec5fbbe3

      SHA1

      4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

      SHA256

      8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

      SHA512

      2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    • C:\Program Files (x86)\GearUPBooster\9155\VCRUNTIME140.dll

      Filesize

      88KB

      MD5

      81b11024a8ed0c9adfd5fbf6916b133c

      SHA1

      c87f446d9655ba2f6fddd33014c75dc783941c33

      SHA256

      eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829

      SHA512

      e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1

    • C:\Program Files (x86)\GearUPBooster\9155\browser.dll

      Filesize

      38KB

      MD5

      1360c1d67a865ba1f6085e2246f42677

      SHA1

      ea3eca123552859a8ef4bd0c2db133acda97c300

      SHA256

      9c25f4fa25116542a9c16d94ababec450c6184c6e8bc3cd90f3d9dc4ed5bcc39

      SHA512

      64c290db722c28cd613cf0674d0fccbc54b1b9c5338b59cecaa2cea1d78ec061793b12eb2289d9b901f84b91fac85b9a6f974e3ca751ac31f788d859a7bdae07

    • C:\Program Files (x86)\GearUPBooster\9155\cache.data

      Filesize

      582KB

      MD5

      6c0298e8499ad4cb63a492cef8c656f9

      SHA1

      d8c62c11ba824d1e39a0d39055c54d4aa9d80569

      SHA256

      da5bc5ee41be955da87448150bdfd6a95b27f6858bcc1ca9bc64a0d28820b3a8

      SHA512

      1e39f31c388be1bcc01274d3cad7421b2f061639ccd0138d41e75e949e6ec9cb13a1445f6e961f968023f949d49c976770481b3d29c2cf3721eeafe1e30310c3

    • C:\Program Files (x86)\GearUPBooster\9155\crashpad_handler.exe

      Filesize

      853KB

      MD5

      5a243339440082631749f4bdff283bf5

      SHA1

      4c3512320b1b3c05ce265037a37aa3f16d3cc57c

      SHA256

      80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150

      SHA512

      c0b889a819ac5cc6904caeb37e504e6a50d33e49a0e6fb6bdaf8e372190c9bca021017103a7dfcedf7e2c8d9c6a1f3eef103cdf389a5f6bb9ff71f03783ebe24

    • C:\Program Files (x86)\GearUPBooster\9155\crashpad_wer.dll

      Filesize

      36KB

      MD5

      e161e5dd4c57dbb72ef46cd60ac7c8b3

      SHA1

      7889c0cd22720bb76195bb8de0b77ebcc8068d57

      SHA256

      e4a2295cff0949d9f0a646f36d7fbaa40fefdbf5958d21b091f95d9c96c345d5

      SHA512

      d08200a5535cfafac52a0fc16b5512863d6d8d70514bd8cd3324451c47cb5cd5d5592c3ac1440308f52d4142c1551a891a1d4ea7332159b2f4c5bd249b6fd100

    • C:\Program Files (x86)\GearUPBooster\9155\gearup_booster.exe

      Filesize

      7.7MB

      MD5

      65b9b5f31e8219bbd995417fe3c4b415

      SHA1

      9ea7a4babab60964aba8816afad647670389513f

      SHA256

      05a21a10bbb7b46ae2a3e296501de6347ddc9d204ea9afb2056ecd13ced002dc

      SHA512

      31d58e7de70e5df28a67a518d10995ad6590d91f57be6aee03f2c7a93bf71f4bb6d5822e1e7d43f8c860d71cfa5a8e237c8dda0fde8e6d20751e80365b66501a

    • C:\Program Files (x86)\GearUPBooster\9155\gearup_booster_ball.exe

      Filesize

      1.4MB

      MD5

      68d00dfd9a92e1031115d3132f529d71

      SHA1

      2b02cd13314f42b105d7fa1d2cf45ebbc1c6c756

      SHA256

      1a2bee6f9ff35f69a9c0c503c3449fc6beb258b0c7f69a3634419139ac876b79

      SHA512

      49676ddccdc364e752e7783d07ac70b262a45cfd2290876c26b2643efe05546bc6d9909bdeaa1c15353891f1a0a543bf1630b1990e02fcee8827842197dcc112

    • C:\Program Files (x86)\GearUPBooster\9155\gearup_booster_render.exe

      Filesize

      1009KB

      MD5

      561e2e81dc8a2abc5c648cdf5b407099

      SHA1

      1ac32fc3858032aa6d3c37b4ef8f2b92fe585e2d

      SHA256

      271dae8bcb2d3f40ab65c3feeed49b9ae2cdd91bfe16230971289e28570c9a7f

      SHA512

      2601e48ad443b98f8b207265eb8e46e6889c4d656e0f677b4f4d7cbc4fc1b1b031189e382f4d118eef6f4b54cb2d16a8179d2184cd8580d8b928b847a46315a8

    • C:\Program Files (x86)\GearUPBooster\9155\gearup_booster_vpn.dll

      Filesize

      33KB

      MD5

      9a4e4b68a7d9a48781996212828dbd5c

      SHA1

      cb64a4e2680226455caf50505b9db397df22f2e6

      SHA256

      435b04e9f1692558a52e906605c12d00fd65199b2ddc36e853645e61174e6c20

      SHA512

      b58a078f713c99b9f47d28e40cf051f85bf70f20348e8a6fdd4e330fa92a51fd3241807eab07ad5f74cfcd23276f531d6b15688b5bc463806a70f230fb47c67b

    • C:\Program Files (x86)\GearUPBooster\9155\hostfp\64\hostpacket.sys

      Filesize

      37KB

      MD5

      5ac815ad2f4386140fe4c7eef3b06233

      SHA1

      6dd0e26f3c447602109253a7eaad59064c4162ca

      SHA256

      08d86eae497df069ef9e6525e9513a019ff7a9971780c1987fde858d51f4ed66

      SHA512

      98cf60aceabadc078e00ad1e274028714f7bbf3c86f0522ab423d50231156a2513e8cc1946b242c64af7287648e6d4ba5e630824b4d83134c471689db42fbbf5

    • C:\Program Files (x86)\GearUPBooster\9155\lunasvg.dll

      Filesize

      344KB

      MD5

      45edee8d5b3f30f280450edfd2a0d7e3

      SHA1

      426cd368ffde347d5160bbd8de7ce492f441590b

      SHA256

      99410178464567de43b0a77cace66b8a4c1531618008604dc6b04741fff5fbd0

      SHA512

      40d95f257b28de69956a1d3c00cd10aab9e5d01484cb30e4a6c010001ac3cdc2264128829e9a91f2218a92b3dd86f31f94d0cd2eeb86acd1fa9c17f09c77b71d

    • C:\Program Files (x86)\GearUPBooster\9155\msvcp100.dll

      Filesize

      411KB

      MD5

      bc83108b18756547013ed443b8cdb31b

      SHA1

      79bcaad3714433e01c7f153b05b781f8d7cb318d

      SHA256

      b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671

      SHA512

      6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

    • C:\Program Files (x86)\GearUPBooster\9155\msvcp140.dll

      Filesize

      432KB

      MD5

      a6b18a2772631cdd06f95b19d66d2d4f

      SHA1

      c342250efab725f643e598f49d1710c74f78d022

      SHA256

      76cc277b564e69e35a0d9c440f013a52b5d25f43ba42fd0099d6fc1f05a6ce16

      SHA512

      f98e07c1b92ecfc662021e33486b660942de390b8e947126f304adee911da0574d6cac416748f6f03e6cce981737eb694fb3d2bcd80e1e207eba91a44b5f23e5

    • C:\Program Files (x86)\GearUPBooster\9155\ping.dll

      Filesize

      737KB

      MD5

      f6d2eb976262c38807a6360400cc7426

      SHA1

      c2c74cc82d3910942902d6a3c34b049ff1dac8f4

      SHA256

      64694d15976d2725fffe371f10c5c9203963da1d6784f7fc2873a89c4171e80d

      SHA512

      0a233d2f87507760d3a61f3b1acd626eff89a961a37802fcd1608e5079def33bcd47c61c6c2a6e58d8b17d98eee71263ff0076591c251d5b3374dd69383a17d2

    • C:\Program Files (x86)\GearUPBooster\9155\sentry.dll

      Filesize

      426KB

      MD5

      bf9002bf5c878cdca749025a5f875d6b

      SHA1

      e916d3121706dbd1ada335b414e4601373b86ef8

      SHA256

      4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05

      SHA512

      34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20

    • C:\Program Files (x86)\GearUPBooster\9155\skin.dll

      Filesize

      12.1MB

      MD5

      eeab6bf7b91f63905b4403415af6415b

      SHA1

      4c6fa62c41ef9441cae4d9aa37b9735474e7ba1b

      SHA256

      f8183accf12862f017180459a1a72cc3d530e7593c71f109cb814ace51462a75

      SHA512

      6236e0534ffc5004e4caf351db3242ebfa93d4ab46d583b893b75998f418b9ab7a75d049b6e037b9602ddcf791e432b107e64208443e7087eb83fce54b22d42d

    • C:\Program Files (x86)\GearUPBooster\9155\ui.dll

      Filesize

      1.1MB

      MD5

      8256d3f4b3fd1eecac8ebd4966bc1d09

      SHA1

      846197d00035e873c5a10e52e8ce99bfb10a1eb8

      SHA256

      ff1cfc47aa9fd35610bde13e00cc71e5b16db15b5ba0e3428b19036020945e70

      SHA512

      f554b7003ba7f3c910e863df197dbbcca664a1946852e4f16571558866207b90989d24da1211428daf7407b4c129e579181106cdbc77d91af91f822b1f9249f1

    • C:\Program Files (x86)\GearUPBooster\9155\uninstall.exe

      Filesize

      2.1MB

      MD5

      00135bef1ab04611975e87cf59c9b866

      SHA1

      4ced109784ac42df55452ebeb92dc377ed46239c

      SHA256

      9e7535baaa9e53830eac7eaa37e54ebd1511797978c5c6fca61d6fb805a4e761

      SHA512

      3d0d8d28eb0f574d6892a7b9b2b0e9a0e4ce1943ffefd1267cb471a17d9cc2e41f1e941bfee89be36b13f90c10fb2d2bc5a84b7ab6a3a5d5c2b6c2e14910c5e0

    • C:\Program Files (x86)\GearUPBooster\9155\update.exe

      Filesize

      2.2MB

      MD5

      d53a5d4026a225ef30fda64ab61da9d4

      SHA1

      37557cb623b046a36e20001048ac49e9b3ec3ac5

      SHA256

      eb51d2eee7bcc6839c52504205eeaeb9dab1eac318e725586ae824d14c899a5a

      SHA512

      ac37d3e80bc865cee829c6ad31bdc946ed6f000a08041a1bcf86a66fb3c83bf03696e68c511d1ea71d4f03a72554c992123feeb3682d7f9d5899f430431fb704

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\cef.pak

      Filesize

      4.7MB

      MD5

      825bf8177072c1199b210cc3ebd3bef6

      SHA1

      aade0547cd841e905c95a1ee0e4d117cfcb8e05b

      SHA256

      e8a2afcb045f9c46097d9bd9d30bf5d42cd43c83ef7f02f39ebffe41d7b945d4

      SHA512

      203915a412ed8d78edcc7619954b117f7b9783439b3af091f7a08d483ec92ff1242709156a6628b354c3402cf4239741dd4d292f33be8f52710764712aa3f68a

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\cef_100_percent.pak

      Filesize

      337KB

      MD5

      d4b5474d852d853227c23e2680505c15

      SHA1

      55b8bd1a1ac03693938969a89acd30a011e24905

      SHA256

      308d2733dc85f84a8559a710ae61de4cf3604ba13aa19bbc5658d56787511a5a

      SHA512

      2f2c6eba0fb3791528c212f6b50e8cbfae63da445cdc885f46ef7670a62acdb06dd447494d2263f58e0ca3ba9d06fb22e80228ec1751923345b47a415bef5406

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\cef_200_percent.pak

      Filesize

      427KB

      MD5

      65aaa3a2e927d1ed763d1ed008620c1e

      SHA1

      30472fa29c68314c782d6161fdf3b6c2dadcd8d2

      SHA256

      757b3bd4d843d0b834e03b5ad52cc7396551f0f01f859b6fd17db3107f80dd49

      SHA512

      21a4fbc96a3562d8388da9226ddb056f06b7286ed057df4d7a35da492848013cdc025c18a826c14f726566f0c44ca150aeed2dba986f168bc9b9b00ef834db62

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\icudtl.dat

      Filesize

      9.7MB

      MD5

      3ed56e55ff45ab973ffc483e5d483a5a

      SHA1

      5d9d39c80054ed315fa4cac23cd956e3121ce5d0

      SHA256

      22b4b162fa9c1a35d086df4b2532485c0ddfee4649de8519cfc52a09f749b8ea

      SHA512

      b8998b76b2691941ea724f404c9b95bfb1593e6fb17d0d7fd57d04069b180a01eec82934357c2dfd48958b6d3d4e3489b111f7c0078134d300710d76f9ee3daf

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\locales\en-US.pak

      Filesize

      197KB

      MD5

      f7696f13a51166fd3efdb3f918c4ce3b

      SHA1

      2a5fb539b40af62ac6140477bff456211ddc6d28

      SHA256

      e572a8d7c366b462f1f2d0dc8577ab73824b8f8b39698e104ca4538d1be908dc

      SHA512

      4a005470cdc0bd84d1fc002a35825ce9bb2648dc0784665a31219a1f2b1e9c246002d051d50f6dfbeed69c1bd4f7f0f70589cfd6dfe65a0365783c1099ef367f

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\natives_blob.bin

      Filesize

      342KB

      MD5

      ddb16ce3c579ab3900139b68dff4d307

      SHA1

      cc274783f8f44576ea17e7077d943aed4f94def6

      SHA256

      3bf49b753358169ed23a41f1a84d16831f16dd389b2b59c62e1ba2ec76d7b9cc

      SHA512

      2fb862f1d9f7a84da850c28ce7546335ec9978e6b43dd94e1adaae7be5a864f4b11c56175e0e170d6ab616a50bf6883d9e695f896f57a95a0ea35eecc8f6536f

    • C:\Program Files (x86)\GearUPBooster\cef\3.0.0\snapshot_blob.bin

      Filesize

      671KB

      MD5

      39a5320c010b68b0e0cc085b1640cdb4

      SHA1

      9111cdadbc3a4609d150c36624e109db5460c87e

      SHA256

      d8ee479ab35e34810f4b18305e89e96f5fb0032df66305eba9ec7ffeee51f576

      SHA512

      2e0f29afbebb91e178446d155784d58ff6d152e1f411a654e11a7ef99ce58e22c9cb9e3e7061ea45b9bdb4130f16a47c8c31a1ed11f97b33a437a8deef49267a

    • C:\Program Files (x86)\GearUPBooster\gearup_booster_temp\7za.exe

      Filesize

      589KB

      MD5

      c6d72642721e84d227defc3ec4ab12e6

      SHA1

      3709a7c3cc795a0012adc6ccaf82a93628703518

      SHA256

      0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035

      SHA512

      fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389

    • C:\Program Files (x86)\GearUPBooster\launcher.exe

      Filesize

      921KB

      MD5

      ffda1f7fbe1d583392297d76c5676b48

      SHA1

      e37229940a14f16c0d7988a01660b86d34ddd5bf

      SHA256

      77fadce88805497a5fb83fe29c9c4a46b5160acd2d09bc90133314529f365868

      SHA512

      4edcf775e4cc1e53fca84b0ad68e9e826b0b379f0675390671c87433d9db2ac1e5fc8a1a330bd2d4300c6cdff3990f051e586d32d155930deb2cb23292a345f9

    • C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log

      Filesize

      103B

      MD5

      a7153a86a95509351d07fa688cc5d750

      SHA1

      e4968a1b9539300fe8714b6e066ab955a5377daa

      SHA256

      606c07a984894f8edb444cea2a95c1d6afb68207616bbfbf74a9704223441cfc

      SHA512

      e231faa2f2e655b9e4c597cb60d79dfbf379fc8d089146bd4e8eab76b14af876a9dbbbe3784133d4d853c7b72d404300bb59cb1288f1994e0bfc95ff0b51fa80

    • C:\Users\Public\Desktop\GearUP Booster.lnk

      Filesize

      1KB

      MD5

      7b4d60205eaf0c412f45d15c85f3da99

      SHA1

      94da6580ac077b2804c1a8a4533a43872efe916f

      SHA256

      0659b6fe75a35583d8e443a75a87840dc56524260153601245e0d231b3be24e0

      SHA512

      c46b39a2af3be5ff7cf41bef33ba8ab29771904cf3029b6c2fd90ce83dc57aa8bbcc4e8d0a83231cff4703ded958c2dfa061c7250d2d9f2facba8db90cb0f0a1

    • memory/3428-415-0x0000000033E00000-0x0000000033E01000-memory.dmp

      Filesize

      4KB