ca96ec9e8d0ad79abbf6a48e69518236544ac0cc7afd0a6c8864d9045599a318

Analysis

user interaction
yes
max time kernel
40s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GearUP-2.66.0-game1044.exe
Size 33.7MB
Sample260424-cm2leacw7x
SHA256 ca96ec9e8d0ad79abbf6a48e69518236544ac0cc7afd0a6c8864d9045599a318
MD5 1c9af66c76c14f2aec836edcfc2313d7
SHA1 272f1c025609c71e85029775a9cc6e6ddf281071
SHA512 e1c6d05038992f3f35f977f4ba95c1738af71ff61b2659fa328b6beb9185f2e87f0243fd01862398aef3d7a77d1a08c2e1765252aa0c9c788d799e429cff11f5
SSDEEP 786432:br68BEIffjRxhNVqre8Ccv6dOcp19MGHTUrM:VEGTh3ae8yP/zUrM
TLSH
T1E4773302BE928072D45B05309E7E97B7C979AB21533185C3A7A97D2C1D307D29E3F36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GearUP\9253\ngpush.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\wfp\win\x64\gunetfilter.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\i386\tap0901.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\launcher.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\api-ms-win-core-file-l2-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\api-ms-win-core-localization-l1-2-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-filesystem-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-heap-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-math-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\udp_connect_lsp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\cache.data	gearup_booster.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\license\curl_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\license\winpacp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\gearup_ball.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\browser.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\crashpad_wer.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\grp.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\tap0901.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\hostfp	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\VisualElements\Logo.png	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\license\libev_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\arm64\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\tap_driver\i386\NW_TAP_0909.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\i386\NW_TAP_0921.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-stdio-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\host_dp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\UniSDK\NGPush\uuxxgu_2_c834c170.json	gearup_ball.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\drvinst_x64.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\wfp\win7\x64	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\tap0901.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-convert-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\NW_TAP_0909.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\license\curl_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\tap0901.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\apiinstall_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-core-file-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\WebView2Loader.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\wfp\win	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\license\jsoncpp_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-utility-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\crashpad_wer.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\fcount_wapper.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\udp_connect_lsp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe	GearUP-2.66.0-game1044.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-multibyte-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\gearup_booster_vpn.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\apiinstall_x64.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\lspinst_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\license\jsoncpp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\NW_TAP_0921.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\tap_driver\x64\OemVista.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\vcruntime140.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\wfp\win7\x64\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\tap_driver\i386\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\shence.log	gearup_booster.exe
File created	C:\Program Files (x86)\GearUP\9253\drvinst_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-math-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\wfp	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\tap_driver\i386\nw_tap_0921.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9253\api-ms-win-crt-multibyte-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9253\host_dp.dll	7za.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Executes dropped EXE 6 IoCs

pid	Process
5872	7za.exe
1008	launcher.exe
3880	gearup_booster.exe
1192	crashpad_handler.exe
3672	gearup_ball.exe
1356	crashpad_handler.exe

Loads dropped DLL 33 IoCs

pid	Process
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
1192	crashpad_handler.exe
1192	crashpad_handler.exe
3880	gearup_booster.exe
3880	gearup_booster.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
3672	gearup_ball.exe
1356	crashpad_handler.exe
1356	crashpad_handler.exe
3672	gearup_ball.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gearup_booster.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x001700000002b601-329.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_booster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GearUP-2.66.0-game1044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_ball.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	GearUP-2.66.0-game1044.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214704195993949"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\0	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\0\win32\ = "C:\\Program Files (x86)\\GearUP\\9253\\dui_webview2.tlb"	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\FLAGS	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\FLAGS\ = "0"	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\0\win32	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUP\\9253\\gearup_booster.exe \"%1\""	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\ = "Webview2QueryLibrary"	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\HELPDIR	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GearUP\\9253"	gearup_booster.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3816	msedgewebview2.exe
3816	msedgewebview2.exe
3816	msedgewebview2.exe
3816	msedgewebview2.exe
3816	msedgewebview2.exe
3816	msedgewebview2.exe
3816	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	5872	7za.exe
Token: 35	5872	7za.exe
Token: SeSecurityPrivilege	5872	7za.exe
Token: SeSecurityPrivilege	5872	7za.exe
Token: SeIncreaseQuotaPrivilege	5176	WMIC.exe
Token: SeSecurityPrivilege	5176	WMIC.exe
Token: SeTakeOwnershipPrivilege	5176	WMIC.exe
Token: SeLoadDriverPrivilege	5176	WMIC.exe
Token: SeSystemProfilePrivilege	5176	WMIC.exe
Token: SeSystemtimePrivilege	5176	WMIC.exe
Token: SeProfSingleProcessPrivilege	5176	WMIC.exe
Token: SeIncBasePriorityPrivilege	5176	WMIC.exe
Token: SeCreatePagefilePrivilege	5176	WMIC.exe
Token: SeBackupPrivilege	5176	WMIC.exe
Token: SeRestorePrivilege	5176	WMIC.exe
Token: SeShutdownPrivilege	5176	WMIC.exe
Token: SeDebugPrivilege	5176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5176	WMIC.exe
Token: SeRemoteShutdownPrivilege	5176	WMIC.exe
Token: SeUndockPrivilege	5176	WMIC.exe
Token: SeManageVolumePrivilege	5176	WMIC.exe
Token: 33	5176	WMIC.exe
Token: 34	5176	WMIC.exe
Token: 35	5176	WMIC.exe
Token: 36	5176	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5176	WMIC.exe
Token: SeSecurityPrivilege	5176	WMIC.exe
Token: SeTakeOwnershipPrivilege	5176	WMIC.exe
Token: SeLoadDriverPrivilege	5176	WMIC.exe
Token: SeSystemProfilePrivilege	5176	WMIC.exe
Token: SeSystemtimePrivilege	5176	WMIC.exe
Token: SeProfSingleProcessPrivilege	5176	WMIC.exe
Token: SeIncBasePriorityPrivilege	5176	WMIC.exe
Token: SeCreatePagefilePrivilege	5176	WMIC.exe
Token: SeBackupPrivilege	5176	WMIC.exe
Token: SeRestorePrivilege	5176	WMIC.exe
Token: SeShutdownPrivilege	5176	WMIC.exe
Token: SeDebugPrivilege	5176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5176	WMIC.exe
Token: SeRemoteShutdownPrivilege	5176	WMIC.exe
Token: SeUndockPrivilege	5176	WMIC.exe
Token: SeManageVolumePrivilege	5176	WMIC.exe
Token: 33	5176	WMIC.exe
Token: 34	5176	WMIC.exe
Token: 35	5176	WMIC.exe
Token: 36	5176	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3880	gearup_booster.exe
3672	gearup_ball.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3880	gearup_booster.exe
3672	gearup_ball.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 5872	3704	GearUP-2.66.0-game1044.exe	80
PID 3704 wrote to memory of 2976	3704	GearUP-2.66.0-game1044.exe	82
PID 3704 wrote to memory of 1008	3704	GearUP-2.66.0-game1044.exe	84
PID 1008 wrote to memory of 3880	1008	launcher.exe	85
PID 3880 wrote to memory of 1192	3880	gearup_booster.exe	86
PID 3880 wrote to memory of 4684	3880	gearup_booster.exe	87
PID 4684 wrote to memory of 5176	4684	cmd.exe	89
PID 3880 wrote to memory of 3816	3880	gearup_booster.exe	92
PID 3816 wrote to memory of 5020	3816	msedgewebview2.exe	93
PID 3880 wrote to memory of 3672	3880	gearup_booster.exe	94
PID 3672 wrote to memory of 1356	3672	gearup_ball.exe	95
PID 3816 wrote to memory of 4760	3816	msedgewebview2.exe	96
PID 3816 wrote to memory of 4760	3816	msedgewebview2.exe	96
PID 3816 wrote to memory of 4760	3816	msedgewebview2.exe	96
PID 3816 wrote to memory of 2764	3816	msedgewebview2.exe	97
PID 3816 wrote to memory of 2492	3816	msedgewebview2.exe	98
PID 3816 wrote to memory of 2492	3816	msedgewebview2.exe	98
PID 3816 wrote to memory of 5556	3816	msedgewebview2.exe	99
PID 3816 wrote to memory of 5556	3816	msedgewebview2.exe	99
PID 3816 wrote to memory of 5556	3816	msedgewebview2.exe	99
PID 3816 wrote to memory of 1496	3816	msedgewebview2.exe	100
PID 3816 wrote to memory of 1496	3816	msedgewebview2.exe	100
PID 3816 wrote to memory of 1496	3816	msedgewebview2.exe	100
PID 3816 wrote to memory of 5820	3816	msedgewebview2.exe	101
PID 3816 wrote to memory of 5820	3816	msedgewebview2.exe	101
PID 3816 wrote to memory of 5820	3816	msedgewebview2.exe	101
PID 3816 wrote to memory of 5960	3816	msedgewebview2.exe	102
PID 3816 wrote to memory of 5960	3816	msedgewebview2.exe	102
PID 3816 wrote to memory of 5960	3816	msedgewebview2.exe	102
PID 3816 wrote to memory of 1412	3816	msedgewebview2.exe	103
PID 3816 wrote to memory of 1412	3816	msedgewebview2.exe	103
PID 3816 wrote to memory of 1412	3816	msedgewebview2.exe	103
PID 3816 wrote to memory of 5704	3816	msedgewebview2.exe	104
PID 3816 wrote to memory of 5704	3816	msedgewebview2.exe	104
PID 3816 wrote to memory of 5704	3816	msedgewebview2.exe	104
PID 3816 wrote to memory of 6036	3816	msedgewebview2.exe	105
PID 3816 wrote to memory of 6036	3816	msedgewebview2.exe	105
PID 3816 wrote to memory of 6036	3816	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\GearUP-2.66.0-game1044.exe
"C:\Users\Admin\AppData\Local\Temp\GearUP-2.66.0-game1044.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
  "C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUP\" -aoa
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUP\gearup_booster_temp\"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976
- C:\Program Files (x86)\GearUP\launcher.exe
  "C:\Program Files (x86)\GearUP\launcher.exe" /install_shortcut 1 /install_autorun 0 /install_id 㤶慥ㅤㅣっ攷昶攰㠳㠳攸摦挀浯
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Program Files (x86)\GearUP\9253\gearup_booster.exe
    "C:\Program Files (x86)\GearUP\9253\gearup_booster.exe" /install_shortcut 1 /install_autorun 0 /install_id 㤶慥ㅤㅣっ攷昶攰㠳㠳攸摦挀浯
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe
      "C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\5ce07900-a1e5-4287-f831-7cc396754f23.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\5ce07900-a1e5-4287-f831-7cc396754f23.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\5ce07900-a1e5-4287-f831-7cc396754f23.run\__sentry-breadcrumb2 --initial-client-data=0x47c,0x480,0x484,0x458,0x488,0x73505160,0x73505174,0x73505184
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --lang=en --mojo-named-platform-channel-pipe=3880.832.5545886209164287499
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3816
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffcf40fb078,0x7ffcf40fb084,0x7ffcf40fb090
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
        5⤵
        
        PID:4760
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
        5⤵
        
        PID:2764
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
        5⤵
        
        PID:2492
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        
        PID:5556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3988,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
        5⤵
        
        PID:1496
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4148,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4308,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
        5⤵
        
        PID:5960
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5328,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
        5⤵
        
        PID:1412
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5180,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5548,i,6358401605215806347,15582720976079751544,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
        5⤵
        
        PID:6036
  - - C:\Program Files (x86)\GearUP\9253\gearup_ball.exe
      C:\Program Files (x86)\GearUP\9253\gearup_ball.exe /main_form_wnd 787038 /show_flag 0 /pos_x -1 /pos_y -1 /version 9253 /client_id 69ead1c9f5bdf813b42f9853 /gray 0
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe
        
        "C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\32ff3ac5-7c99-4ae9-8ffe-54f464add20d.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\32ff3ac5-7c99-4ae9-8ffe-54f464add20d.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\32ff3ac5-7c99-4ae9-8ffe-54f464add20d.run\__sentry-breadcrumb2 --initial-client-data=0x460,0x464,0x468,0x43c,0x46c,0x73505160,0x73505174,0x73505184
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCR100.dll

Path C:\Program Files (x86)\GearUP\9253\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NGPush.dll

Path C:\Program Files (x86)\GearUP\9253\NGPush.dll
Size 6.7MB
SHA256 bd3a87dbb6199c0a8b486e779454743b7cfa845e96069ceeca002d4d1f0cdc27
MD5 3f8752a0eaf92532dbde97e93ff6f762
SHA1 3e0ab23e1b0daa7b0be9e9d3a382caf1b41c0f47
SHA512 a9c1bde7835c76c4cc719082f469881a31d81e12c7d11e8900e7bfd45eab46f1053fa7907cb7ac1a209fc1c321711e2bcd411d2836288dade6bd383781709150
SSDEEP 98304:yvky8kf7yeV4fZiu+nETmnZeGA14uu+Pb4G0hqB6SJ1yh6:Wkcf7PeTjSvSz
TLSH
T1B066B022BB568161EACF41BA55BE6BBF4A3C4A144B3540D3D6C42D6ECD305C23B3E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files (x86)\GearUP\9253\VCRUNTIME140.dll
Size 88KB
SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
MD5 81b11024a8ed0c9adfd5fbf6916b133c
SHA1 c87f446d9655ba2f6fddd33014c75dc783941c33
SHA512 e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1
SSDEEP 1536:ckch/beb1bBhdXPFSAS7wIVktX8/eZT2G//ecb2Z0X3I+zl3z:ck2+1blXPg7wIVkts/UF/ecb2a5F
TLSH
T14E937C02B5D48071D9BE18B643A9D6027A7DB3A14FD60AEB5FA59CC89FB57C0E730207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\GearUP\9253\WebView2Loader.dll
Size 113KB
SHA256 4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c
MD5 999f67ef1a2d06beeaf85ec9b5d5d73d
SHA1 644b1768f8675b29fb53a51edb5d344fdf55946c
SHA512 6399fda1c54bd26ce82b7d48ac1b7c9741d5abf68a67bd62ec53ea2a1f82caac2e9bfdb1cb22f5af3c8ca6f4789a888f6519e02941f6c33f6f9d3b0e58eb56f4
SSDEEP 3072:OnbFYqJx7sXRq2KVs9iiamgqeNZPTj7EtJlAlHJcgf4fm9pS:OZYqJx4gkYiavEtJe9f2mbS
TLSH
T130B36B5176D08072E9BE0A380874DB655B3F7960DFA09DEB67845AA94F317C0CE34E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.dll

Path C:\Program Files (x86)\GearUP\9253\browser.dll
Size 38KB
SHA256 9c25f4fa25116542a9c16d94ababec450c6184c6e8bc3cd90f3d9dc4ed5bcc39
MD5 1360c1d67a865ba1f6085e2246f42677
SHA1 ea3eca123552859a8ef4bd0c2db133acda97c300
SHA512 64c290db722c28cd613cf0674d0fccbc54b1b9c5338b59cecaa2cea1d78ec061793b12eb2289d9b901f84b91fac85b9a6f974e3ca751ac31f788d859a7bdae07
SSDEEP 768:W2S9NVky9us6E7y9AHCvQm0OfqodafH6VV4abtkYiQr4:V8NV5eE7ygOf8S4Gk7v
TLSH
T12F0370074908C8B6DE48193B39A455175E9CE7B627A08CE3E792C0987FE3ED63D761C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.data

Path C:\Program Files (x86)\GearUP\9253\cache.data
Size 596KB
SHA256 4552c987098a9cd855f87213104e6cb742621a989b850474f10ae9625b8d2bec
MD5 27ddf2c764ebe28af6aaf0ef6187950d
SHA1 02500b0fa9271409d5844e36b478b792de553d88
SHA512 17c1ae848ff4d981244b7e234e64f370bb1ffb5aa9e1bd1dfc04e06914ef66450a0678406fa265a59ead200c3dc9f579b84be4e45259b6836831c6518fd8ee57
SSDEEP 12288:k9iPit7uyeB3Sgw2FZOH6d/lLNJv2YxCbe0snEzBti38hp+:kMPiVuNS12bAGTv2wCV48hp+
TLSH
T129D4233053AD8F25DA420F5B9D77DE25FB820AC22580369F8504327006AD7DED6D6BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe
Size 853KB
SHA256 80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150
MD5 5a243339440082631749f4bdff283bf5
SHA1 4c3512320b1b3c05ce265037a37aa3f16d3cc57c
SHA512 c0b889a819ac5cc6904caeb37e504e6a50d33e49a0e6fb6bdaf8e372190c9bca021017103a7dfcedf7e2c8d9c6a1f3eef103cdf389a5f6bb9ff71f03783ebe24
SSDEEP 24576:CLblY9+TeiDrZAdMgz3QZ5qY0xTHeMjoOvQdp89T7a0DPafB:0l7xKWnqY0xTHeMjoOvQdpCT7a0C
TLSH
T1F0057D307E1AC135EE5201F389AC6BEB81AD951A8B7706C361C8576D6A742E33F33917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_wer.dll

Path C:\Program Files (x86)\GearUP\9253\crashpad_wer.dll
Size 36KB
SHA256 e4a2295cff0949d9f0a646f36d7fbaa40fefdbf5958d21b091f95d9c96c345d5
MD5 e161e5dd4c57dbb72ef46cd60ac7c8b3
SHA1 7889c0cd22720bb76195bb8de0b77ebcc8068d57
SHA512 d08200a5535cfafac52a0fc16b5512863d6d8d70514bd8cd3324451c47cb5cd5d5592c3ac1440308f52d4142c1551a891a1d4ea7332159b2f4c5bd249b6fd100
SSDEEP 384:U2DgZd8t/u9aQZjkfXUEHQIYi7caPxh8E9VF0NyUzDUf:U2DXt/uLKsu5Yi7BPxWEiEf
TLSH
T1D1F27DA68D242D23DFDF4A74B0E449764E7466005FA180D3732EC2994F993C3BBB916E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcount_wapper.dll

Path C:\Program Files (x86)\GearUP\9253\fcount_wapper.dll
Size 542KB
SHA256 3345be5535b02b1628c9f1714ca8674d2ab219583509a3caf1f84a45f7ca770f
MD5 8a8a28fdd6b55b52a659005eb360ed42
SHA1 30f48d682057f956680f1b2c642acf9eae2b4b20
SHA512 7a0ca18927416a9a6031d03d1f9d5524529d5355a614e6975ed88d5d815d353b141e30ccaed91c81b561c8a83d4fd6c8ef336422b61f58aa4cb0ee41d48fd2df
SSDEEP 6144:lm0An5cdNm/iUx0DJPsVIM9ot8yIBzQnUq3h86Y7hL/4LhRZ3nRkSqVEikL9ewt5:lbowNmzxHXotBzdh8XTUhD3nfPIjKT
TLSH
T1E2C46B30A241A13BE8FF00B5C8BDAA5D555C5B30072458DFB7CCAD6E9BB96C0AB30657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_ball.exe

Path C:\Program Files (x86)\GearUP\9253\gearup_ball.exe
Size 2.0MB
SHA256 c209e25f434303d53c3128f6b4565d1b4c98e361331cbed62a14a8fd269fef14
MD5 a7d901fcb82b5902e5e5058f00bb810a
SHA1 f04a50773b12d42855392c95cbf3689ad07c030c
SHA512 a35e35f9b29095caad0095a432919291ded106b08bffa2f30459bdef8986e69e78f2ca81515e77e9728533fd71a6c35ed30dcdc980bbd2cf11cb4e76ec603267
SSDEEP 49152:KwgLCD0TyP/w9OEbEeA2vXxgZupkyqGA0dofyh:rgLnk/w9O+1GZhyt
TLSH
T17FA58C02AF834476E55F0A759EBE573ECA38AE10033495C3D39F3C6568716E26D3A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.exe

Path C:\Program Files (x86)\GearUP\9253\gearup_booster.exe
Size 9.6MB
SHA256 ed46a15fd0264b571aaac7a54745c0a1e7097adddf272fb8e8b6bc0f04743d53
MD5 d61396b6cc8a2b3014442bbdfd85ad2c
SHA1 0234061515939923cde9df21d61503a7fd2e9e52
SHA512 9b9b10597aa9826a72b9342588fef336b86a6be1151f15978eac6c679626024709242860c68b5604770aa095788900c7f6620cb51bbfb19929ae466ee247f421
SSDEEP 98304:IzBjp0sDtXtnIm4Bd+2OpDhkW/kDSyTqysrPg5g3PzzdNvEK5EEmZcgDvFxR5ylI:Ifgy9eO2AzvEK5ExcgDvFxo9n2
TLSH
T131A63A11BAB28119F8F715FBDDBD9A5D843D7D60072C80C7938838A968A29C66D31F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files (x86)\GearUP\9253\libcurl.dll
Size 5.5MB
SHA256 028dfda38f9aa9bbed5ca3ef6a67cd66ea5e44d68b7781d9717b35b138115fe8
MD5 745b206e518eea5b73bfed7631ccbc9d
SHA1 4422c68c5939833a5fd6169f7c05fed2bfec6f7f
SHA512 8406cef16c550e995fd1e744f59a8fa2c557e9eccd4de6e6ccbecc317fbab46f601f0280ef2b53daf6e3b37b320888443738b3336467146157e527501b07f02a
SSDEEP 98304:0cGYaW1dJbQbLC9b00oA9/4uAxCarTSbcV5:0+aiZoGTH/+xvmQV5
TLSH
T15B46AD17FF8266A0E9CE427E12FF6B7F4D3A5A18972494D38A5128E8C8716D1733E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lunasvg.dll

Path C:\Program Files (x86)\GearUP\9253\lunasvg.dll
Size 484KB
SHA256 6a6991d8d36530b566c98324db4fce30fdf834f9db6291bc1f27443d4d280c56
MD5 5b4fd4e5171e635a0adbaf46396c54e2
SHA1 d2d10ffe8a85f28b35071a327a053543ce26a230
SHA512 dac6a5ffba6c0ec46086309bd4feb7b8f90d22c25e8081fc6089d78f89b2fed98d8f50aa586ab6e4a23eee11c05fe4ef57215ca92a80b913467f1aebd56df500
SSDEEP 12288:E6JcA+NdGkkSEvhf2g1LKYH5HMHt/yGdC:E6JcA+pkSahf2KLKYZHCtd
TLSH
T17DB4AE32B822C271F9D912F1F9BD6FAF55396E2007AD4AC367C848A5C5609D367B3243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Program Files (x86)\GearUP\9253\msvcp100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\GearUP\9253\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ping.dll

Path C:\Program Files (x86)\GearUP\9253\ping.dll
Size 1.5MB
SHA256 007be5267c0539e5fc3c59f22f40e0b9258dd445ae582f249a323e975cba97fa
MD5 db879ebacc66ea89aad5d64928e19cc2
SHA1 4dfde727b0df7cc5daa1eea4fd6f8d04171e2492
SHA512 4741dca65babaed8322d78cdc47e065d2bf295891fae66d13148b4b795b9efa737ec462879efc5eb98df643030257af52e5cc3cd0d5eb3f513a487582f7a1324
SSDEEP 49152:quP6xnO2YorahLOuWdy24HZpkK7ij3p4/W4t:zP6nrahLOdV4H8Km0
TLSH
T1F975BF03FB8644B2E84F0B3962B7A77F9E359A018324CAD3DB603D559C612D1A63E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Program Files (x86)\GearUP\9253\sentry.dll
Size 426KB
SHA256 4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05
MD5 bf9002bf5c878cdca749025a5f875d6b
SHA1 e916d3121706dbd1ada335b414e4601373b86ef8
SHA512 34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20
SSDEEP 6144:p7HglxMmuzFL2PHajb28r4A/Y7+E/P1cVYr9BeVWiOYaGXQB+r7eY:p7HAx3IFL22707+oKVejeVWiOYaGXQK
TLSH
T13B946B313E15C275FEDA01F6E8FE4FEA896C5965473A01C36AC826957A700D73B3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.dll

Path C:\Program Files (x86)\GearUP\9253\skin.dll
Size 13.2MB
SHA256 70320c5639fc40bc37ac73aa8bbe71e8d5396dd8efd82a56806bb881a06f904a
MD5 0b3fbfccdb7a837e7de2a331a4833360
SHA1 161c3622e593f847dce245a9d61ac35daf0d97e5
SHA512 3abc646e940ab37aa090bd2a53a09315fca5e15abbd73aade2a0d4566bd76073098b5dee2029676402ede30f898781913c159af7d197337d6200288cbc01fa86
SSDEEP 393216:Ca9RpJFMxnh348rsRIWypH2JJJNQpFJd6Nw0:Ca63408NQpFfm/
TLSH
T1FBD612D3F32BA994C62B5F352CF75690A437FA798F21310B6410F7A26DE3AC14A46385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.dll

Path C:\Program Files (x86)\GearUP\9253\ui.dll
Size 1.2MB
SHA256 a7aa372b0c614d8d2febe8c90fccf5c924980999324432db3d301cfd4373af88
MD5 458c5e26ce7459dc674e7958fd3bba9e
SHA1 51b956a0524f483589da486459a3df6d53e6c88f
SHA512 b32a395b50da854e0bd9e895835dcf1ce5d2ab566bde0b4181d2d1c1b723e6c82eb660fb1461b6a6a70e26a3a8ecfb7b3fa4179b5bbff216aff6598acd48d201
SSDEEP 24576:hSgXAenc1qhLLHSKCq9u4mSADInx7e8Jv:HQenc1UHH19uLDInxC8Jv
TLSH
T1A65539702E5481BDEF92D176CE3C7A6D64AD92421F2082C372DD0F196D674E39B326A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui_webview2.dll

Path C:\Program Files (x86)\GearUP\9253\ui_webview2.dll
Size 229KB
SHA256 aa2de319f135a8b8e79574b4a1b67b0be1f56da253320940cd8cd467b93758d5
MD5 485a0db8c99a36dc2307e42e94bcd127
SHA1 88334dc68e74fd2633ffb827578a3f8f30a7c13d
SHA512 bf8393b1caf83da9b840a77671f5e825c533b0464f3cbc6a88b214e9c0d3513950662eac6553f2e690ac7e1ff0e005b0eebf5d5431a119913c83dfec8fe9cb84
SSDEEP 6144:1oeb8JA/zI7yXtaKoqMIQbMQb/Ab/bkbBb9bMQbzlbZcp+jCnvrdTFdwu5huRdG3:Kw8JAbIYtaKoq4bMQb/Ab/bkbBb9bMQc
TLSH
T1D0345C317145C939E3CE02B4886AEBDE52ACB5325FA1C2C7B7DCDE2E0D612D12A35617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files (x86)\GearUP\9253\uninstall.exe
Size 2.9MB
SHA256 ebbc2f5c1c75aab8b606cca405f1a0aa73a0758009da4c7076124456afa1f0d2
MD5 59762eaeb882a8bd3ce0f012e1f7e808
SHA1 ebe64ae526f5c314d3bb00d87d45d69ec827d3e5
SHA512 5b2630d1f77498e6aaa7e7a6a017a2d43ddf905115eb47277d9f43cd71545e74c2079543cb60a2877fe091c942def570a6c056e8aeb180314aeee8f7ae6447f8
SSDEEP 49152:Nl7uhHTZKcN/uesR7yv9APav2el3c+lomDOA/Dipk7bJNMbRd91yxr+Ltp:fWN/u9W3c+lokOA/DF7DMvp
TLSH
T14EE5C012FA868072D467063455BAA77B9D39AE204334C5C3F7A53D2C5D706D2AA3F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Program Files (x86)\GearUP\9253\update.exe
Size 3.0MB
SHA256 2c1cd67aa04f5fea43b5ddb31b811f4abea9590d7290eb1ef3fe0fb3af5fa5d6
MD5 8fd2fe3995a1554a57b78e6ab924e066
SHA1 242de76627a15b193e7213f1e37153ef852a249b
SHA512 93ef4867f60e29e42d95beff0613cb4652f108764a43f02a672db52c67bb48af2dd19618a2285541ce1b69dad87f42959f6371382971b38d99ea94a3d105b450
SSDEEP 49152:awb+zCkIr3tqyz7gRkNlCBuvncjpJth4rCpkYvaCRBzgZtDeC4Ap9GD3okU:pakNlNcjpF4rlYyA1C4cF
TLSH
T1C8E5BF02BE478072D56F06349DBE677AC939AD205334C5C7A7AF3C6C18716D2AD3A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\GearUP\9253\zlib1.dll
Size 77KB
SHA256 b9cbdf114c7c403d844550c12d7dd8c755cd58b5b4f99135d812bafd444364ac
MD5 e3523734f05af14a7b74bc026e3d31b1
SHA1 bc54a7b2adde2004903840ed8279e8b975c67fc2
SHA512 1c81bf56978e86299fa21573e6a6cfe942b7289ecb8e7ee4b1a67af3639d1b45d4274f00f35a0cff4d0e75da420e9fce4183ef439ff9cc62914f3df563a27104
SSDEEP 1536:z77FCOWzicqQPFwYZEABJx98se//002UldXfyIOsIOpcKjKr:TFlWWQuaEsJ0JbXfQipcKj
TLSH
T113739D41AB9143F5D4F5017681F7472DD63630208B87ECEBE28DB6E988127D1AB362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
Size 589KB
SHA256 0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035
MD5 c6d72642721e84d227defc3ec4ab12e6
SHA1 3709a7c3cc795a0012adc6ccaf82a93628703518
SHA512 fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389
SSDEEP 12288:qwW5Af1q9Wq0/rxaxQhlS/a4zdFGDyV+LrnYkdcmE1GN6:qwWO+BElQa4xFGe2rnYkdcb1
TLSH
T1FBD48E133AF5C0BED6620530CA1E6BF5A0FA97680B2248C767D08E1D1B798D5C636E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.zip

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip
Size 26.9MB
SHA256 91009ffa6622f1b03762ba659a275d144f0a434429d6a0dad44021a1186e8ce9
MD5 9b3a1a86430444c7c160a34e9abc7125
SHA1 68d613339e4fcc54aab13388fc7d56ae1444a5cd
SHA512 547664fb784762c6c128ba8cacd9ddfb64aa4947eeaae0cc44159bc1dff0ec2f9dc03de50d66eac5511e3aaf0e6f3742f5265aa6360fe631b3b5746e5eef4db8
SSDEEP 393216:AwJbQjRaX+hNVqrX8x7mFCRi+/Rcez/D3qT6rxSAxUjTdbQKSPMY19MGHmQj54q3:AfjRxhNVqre8Ccv6dOcp19MGHTUrq
TLSH
T118573323B971A1E6888714D276BF0E9157A88FFFAF512120A634C065580F3DB4A7D73E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files (x86)\GearUP\launcher.exe
Size 1.7MB
SHA256 f3f0d418307eca8d54403edc1873e165e0f245f8f001f4761b1c4335f920c87f
MD5 6bb3f9b9bd8e0b9a0fc88e9000a8a0a4
SHA1 7a9220b24228461c503240070cc285599808e7ef
SHA512 617e7e354ea70e792a6cc40d8ef38b17a33e461db9b4fe2c0b1c311b10bf45c3ae412e75c2798127c62161e3b29c1c0040e720ebbfec5d211783a4eefc7e50dd
SSDEEP 49152:tQlmPA/6F+MEBcxmh0tlee0QpkvGX+hnh:tb+MEg40tX0XvL
TLSH
T19F85AE02BE8384B2D84E0A399DBE977FCE35AA114335C6C39B5F3C5458216D25E3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GearUP.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP.lnk
Size 1KB
SHA256 f51c1c3bc1b302f2d64b4c1a205e970f7d274609319b950beffa281910ac2497
MD5 84119b72f313110117f6e2eb84308f67
SHA1 2ed17513d50e929ab5227af754b69159e13e30a8
SHA512 72ccf7107f2af34a193b2125856ebc5db75264a751b22a69aa7efd1b1af05f0ba764bf6674ef0f33b03bbf93f919cf894c75034d69641950868dd0d48727cd7b
TLSH
T14441AB480FDB4716F37BEA316D7647626527F812F3240B3D81C0C34545BA50966ACF7A
MD5 SHA1 SHA512 TLSH

Submit Download

gu.log

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
Size 1KB
SHA256 7f70f0ed7769287feaeb9baec4773af7d43e1d7f5a73879fe57aee1c9fd37c4b
MD5 40efbd6551c485ff788cc820d9e693db
SHA1 2a61cc0224f0ebc0f4587eb5e7468bd0065d3c56
SHA512 90a7693f1dea1e2bce995419affdff37ed8303cb0ed2ce66692164271dd7f5b15030d438ba03c80ff319c91c9af7cdbc874eac012fef262ba7a5715a1dc9e216
TLSH
T14C31527415AC2F9E49ABD13BFE7F0F19B0890528E0417C021186993606A7FAB77F014C
MD5 SHA1 SHA512 TLSH

Submit Download

5a0c332b-acf0-4865-9655-55d0e3e99ead.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\5a0c332b-acf0-4865-9655-55d0e3e99ead.tmp
Size 1KB
SHA256 6428c8915619375d0312eac7c209556281b30919f9625bb9a6868d0ada20dbf2
MD5 9f279bc9d260b79247e515c592d31d53
SHA1 add9a6145550e4379aea0d9930dd66080f737bd2
SHA512 42fc4a20266754968ee934dd6f327f378d0d1de77ffaade5bf220bb396ecdcafda7a2286814da6573e962af530832e95ff3048ccc1c2cc6c8031faf5abe58a1d
TLSH
T15C316573E4A02F729C91A68231022B575D21017B82944F4855DE4B1C01FB7CDA53BC35
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f87e044f7e998a18c9623ac8b89db62fdf92a345aebbc23c40b3f5544eab661d
MD5 1c42cbbd9093d1f7cf325cff12ae6f03
SHA1 a231de9522fa0bf97d8f9a0094cd5db651da7198
SHA512 3ca67f1d5e583e78813b66ad95a5c885d5608f1bddacbba3a608d084aea4dbfc0e1b0ab98d3c420f34c90ec0d8ea3d290cb7278107234ccea91f0c5afd3efe9c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ae5bb68d9698ed8587624d31a24046280ce90cc7785090cf662c192bbb712958
MD5 675db49766241bba0f5f55bd2b19954f
SHA1 e514d4612217df038aac590f9da32b41ed3a1965
SHA512 cf5edbc8bb425de4aaafb6a433339f008b3805b307d08b14e078bcb48ec4e237b6e476807bbb0db82345fe20b1f86889d780027fb5834eee84e255bcea050cd6
TLSH
T1C0D0112332A28A38C02822330003A20C0A82C28B800A8000E8288A2EAA080A00A2A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 38862f29be3ef0584429921034be21533c4c2034568f5f44a0df50880b57ba56
MD5 e7c48ea8d487a9b2486702a431d455fa
SHA1 30a299850513c179dc68bce6d37b1f919fc2fa80
SHA512 8a99590bf91fbe0d87b96907f8e456abe77fd873506bd21b87506b6e829cc8bd2296cecce9a5d5a8dc4c7771325f3d278b02b80e3c69b2d214d20318f987cfa0
TLSH
T126D02B1731229E20C42434370102A30D3E90C04A404380018C2B440F8E640D12AD6549
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 15KB
SHA256 b503bc3a6168f2425550b1a9d41f2b0bb5f93a96a21e418138c38ae7240049b8
MD5 8a2e5812f9176e8a94f56ffd13d63fd7
SHA1 529cf17dc24adf3d627045010dd3c3c14e46e661
SHA512 78c7026d870af519a2c73398fe0d27d767e68211ea9aa675eca88e3cffab1c8c517eb4f30e69b2306e6e82c4ec7f645651dda4be2b87302c7e8cc94cde7055f7
SSDEEP 384:zXfRE5BdEZfr0kuh9Rt/nP9yxNbjWygezurQ8:zRkurqhNsnVdIQ8
TLSH
T13D72BF738A31AD276CFB8606390A2B07A5B4845E56D26A88BCCD5F1D07D77DA1323D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 2KB
SHA256 6cbefbfe83b1f4520a94a62dcb4247302949a71a531c3c07320e4d1d836189af
MD5 78a11b74dfbe7e6c47683fd99f68bd49
SHA1 54af7e5d2e1529393da42d0bbb17a9415210bacc
SHA512 a94aeee577f8201c4e12f6d5bbc801fc65d22ab9a9bf3297183c4f01a2d8840d4a75da1c985735ab048398434d55058330f51c43da8ee08908eb5258685d6a7a
TLSH
T18351D773B864AE7788E39A4179063F239A3141768BD12F559AED0B1C00EB79C2323C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 3KB
SHA256 8741820ac0307679e83708cffb91e29eefadc4ae0d1896c8c866deb7265206cd
MD5 bf6a8d5b9f956c8163cc38b33809aeb1
SHA1 9f562a214689ab220a506b478db817fe5562dc9b
SHA512 a248571a25ff6703adf8f6a521bc3f9823a95779ee45c095e838ee1398ad57aff0b27b4267de9a93dbc55fdd609cac5f86bf65b2be6f3ddec7f8c9e3e0b98aa7
TLSH
T1C071A737A974A9274DF2DA41B8862B17B6610137D5D43F99D9ED0F0C01EB7D82322C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58b3da.TMP

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State~RFe58b3da.TMP
Size 1KB
SHA256 16eb620b699e541ad910c585d3080de6f9caaed9ad91dc37c6cf9129a60f632a
MD5 cb05967281dcc8e3fc9dcb91d85bf674
SHA1 689c531e845726eec8317da98b03b3d52505d4b7
SHA512 2a49587a3b0dfe4aba7a85c4b2bcde016db87007186e343a804ec1ea66986cee887fc6e80f3627b6b6c31f4e0d02a86d4464aa676231b7bd8dd9e19349231df8
TLSH
T1D521B433D4E47E72AC95A99131132B871D20017B86988F0D92DE471D02FBBCDAA3BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1008-532-0x00000000010B0000-0x00000000010CA000-memory.dmp

Download

memory/1192-535-0x0000000001010000-0x000000000102A000-memory.dmp

Download

memory/1356-560-0x0000000000B30000-0x0000000000B4A000-memory.dmp

Download

memory/3672-552-0x00000000012A0000-0x00000000012BA000-memory.dmp

Download

memory/3704-0-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/3816-551-0x000001B587680000-0x000001B5876DD000-memory.dmp

Download

memory/3880-533-0x00000000011A0000-0x00000000011BA000-memory.dmp

Download

memory/3880-534-0x00000000014B0000-0x00000000014B6000-memory.dmp

Download

memory/4684-315-0x0000000000720000-0x000000000073A000-memory.dmp

Download

memory/4760-369-0x00007FFD11D90000-0x00007FFD11D91000-memory.dmp

Download

memory/5176-314-0x0000000002FC0000-0x0000000003020000-memory.dmp

Download

memory/5556-472-0x00007FFD11D90000-0x00007FFD11D91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads