hxxps://www[.]gearupbooster[.]com/ru/

Analysis

user interaction
yes
max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.gearupbooster.com/ru/
Sample260908-pxe7dazhrf

Score

8^/10

adware bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
215	3808	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
4852	GearUP-3.2.1-win.exe
1756	GearUP-3.2.1-win.exe
3892	7za.exe
716	launcher.exe
3472	gearup_booster.exe
1056	crashpad_handler.exe
1924	gearup_ball.exe
2340	crashpad_handler.exe

Loads dropped DLL 32 IoCs

pid	Process
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
1056	crashpad_handler.exe
1056	crashpad_handler.exe
3472	gearup_booster.exe
3472	gearup_booster.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
1924	gearup_ball.exe
2340	crashpad_handler.exe
2340	crashpad_handler.exe
1924	gearup_ball.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gearup_booster.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\arm64\tap0901.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\x64\nw_tap_0921.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\api-ms-win-crt-environment-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\lsp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\openvpn.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\tap_driver\x64\nw_tap_0921.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\launcher.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\msvcp140.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\UniSDK\NGPush\uuxxgu_2_c834c170.json	gearup_ball.exe
File created	C:\Program Files (x86)\GearUP\9270\license\winpacp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\gearup_ball.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe	GearUP-3.2.1-win.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\wfp\win\x64	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\crashpad_wer.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\host_dp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\vcruntime140.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\hostfp\64\hostpacket.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\license\protobuf-lite_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\uninstall.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\msvcp140.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\hostfp\64\hostpacket.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\wfp\win7\x32\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\tap_driver\x64\NW_TAP_0921.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\NW_TAP_0909.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\libcurl.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\license\lunasvg_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\license\openssl_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\nw_tap_0921.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\grp.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\udp_connect_lsp64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\x64\NW_TAP_0909.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\x64\NW_TAP_0921.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\grp.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\nw_tap_0909.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\api-ms-win-crt-heap-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\ngpush.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\wfp\win\x64\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\NW_TAP_0921.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\x64\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\api-ms-win-core-file-l2-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\zlib1.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\wfp\win7\x32\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\wfp\win\x64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\license\jsoncpp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\license\kcp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\license\netfilter_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\arm64\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\hostfp\32\hostpacket.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\7za.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\gearup_booster_vpn.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\tcp_proxy.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\launcher.VisualElementsManifest.xml	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\tap_driver\i386\NW_TAP_0921.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\api-ms-win-crt-utility-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\msvcp100.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9270\wfp\win\x64\gunetfilter.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\wintun\LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9270\drvinst_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\launcher.exe	7za.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe
3732	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GearUP-3.2.1-win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GearUP-3.2.1-win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_booster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_ball.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	GearUP-3.2.1-win.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333449457704313"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUP\\9270\\gearup_booster.exe \"%1\""	gearup_booster.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{2B958A20-E96C-4BEC-9936-3D738F60C6F2}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3472	gearup_booster.exe
3472	gearup_booster.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
3864	msedgewebview2.exe
3864	msedgewebview2.exe
3864	msedgewebview2.exe
3864	msedgewebview2.exe
3864	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	3892	7za.exe
Token: 35	3892	7za.exe
Token: SeSecurityPrivilege	3892	7za.exe
Token: SeSecurityPrivilege	3892	7za.exe
Token: SeIncreaseQuotaPrivilege	4740	WMIC.exe
Token: SeSecurityPrivilege	4740	WMIC.exe
Token: SeTakeOwnershipPrivilege	4740	WMIC.exe
Token: SeLoadDriverPrivilege	4740	WMIC.exe
Token: SeSystemProfilePrivilege	4740	WMIC.exe
Token: SeSystemtimePrivilege	4740	WMIC.exe
Token: SeProfSingleProcessPrivilege	4740	WMIC.exe
Token: SeIncBasePriorityPrivilege	4740	WMIC.exe
Token: SeCreatePagefilePrivilege	4740	WMIC.exe
Token: SeBackupPrivilege	4740	WMIC.exe
Token: SeRestorePrivilege	4740	WMIC.exe
Token: SeShutdownPrivilege	4740	WMIC.exe
Token: SeDebugPrivilege	4740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4740	WMIC.exe
Token: SeRemoteShutdownPrivilege	4740	WMIC.exe
Token: SeUndockPrivilege	4740	WMIC.exe
Token: SeManageVolumePrivilege	4740	WMIC.exe
Token: 33	4740	WMIC.exe
Token: 34	4740	WMIC.exe
Token: 35	4740	WMIC.exe
Token: 36	4740	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4740	WMIC.exe
Token: SeSecurityPrivilege	4740	WMIC.exe
Token: SeTakeOwnershipPrivilege	4740	WMIC.exe
Token: SeLoadDriverPrivilege	4740	WMIC.exe
Token: SeSystemProfilePrivilege	4740	WMIC.exe
Token: SeSystemtimePrivilege	4740	WMIC.exe
Token: SeProfSingleProcessPrivilege	4740	WMIC.exe
Token: SeIncBasePriorityPrivilege	4740	WMIC.exe
Token: SeCreatePagefilePrivilege	4740	WMIC.exe
Token: SeBackupPrivilege	4740	WMIC.exe
Token: SeRestorePrivilege	4740	WMIC.exe
Token: SeShutdownPrivilege	4740	WMIC.exe
Token: SeDebugPrivilege	4740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4740	WMIC.exe
Token: SeRemoteShutdownPrivilege	4740	WMIC.exe
Token: SeUndockPrivilege	4740	WMIC.exe
Token: SeManageVolumePrivilege	4740	WMIC.exe
Token: 33	4740	WMIC.exe
Token: 34	4740	WMIC.exe
Token: 35	4740	WMIC.exe
Token: 36	4740	WMIC.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
1924	gearup_ball.exe
3472	gearup_booster.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
1924	gearup_ball.exe
3472	gearup_booster.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4852	GearUP-3.2.1-win.exe
1756	GearUP-3.2.1-win.exe
3892	7za.exe
716	launcher.exe
3472	gearup_booster.exe
1056	crashpad_handler.exe
3732	cmd.exe
1924	gearup_ball.exe
2340	crashpad_handler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1156	5100	msedge.exe	88
PID 5100 wrote to memory of 412	5100	msedge.exe	89
PID 5100 wrote to memory of 3808	5100	msedge.exe	90
PID 5100 wrote to memory of 412	5100	msedge.exe	89
PID 5100 wrote to memory of 412	5100	msedge.exe	89
PID 5100 wrote to memory of 4860	5100	msedge.exe	91
PID 5100 wrote to memory of 4860	5100	msedge.exe	91
PID 5100 wrote to memory of 2408	5100	msedge.exe	92
PID 5100 wrote to memory of 2408	5100	msedge.exe	92
PID 5100 wrote to memory of 2408	5100	msedge.exe	92
PID 5100 wrote to memory of 748	5100	msedge.exe	93
PID 5100 wrote to memory of 748	5100	msedge.exe	93
PID 5100 wrote to memory of 748	5100	msedge.exe	93
PID 5100 wrote to memory of 1764	5100	msedge.exe	95
PID 5100 wrote to memory of 2012	5100	msedge.exe	96
PID 5100 wrote to memory of 1764	5100	msedge.exe	95
PID 5100 wrote to memory of 1764	5100	msedge.exe	95
PID 5100 wrote to memory of 2012	5100	msedge.exe	96
PID 5100 wrote to memory of 2012	5100	msedge.exe	96
PID 5100 wrote to memory of 4868	5100	msedge.exe	99
PID 5100 wrote to memory of 1008	5100	msedge.exe	100
PID 5100 wrote to memory of 4868	5100	msedge.exe	99
PID 5100 wrote to memory of 1008	5100	msedge.exe	100
PID 5100 wrote to memory of 3124	5100	msedge.exe	102
PID 5100 wrote to memory of 4664	5100	msedge.exe	103
PID 5100 wrote to memory of 4664	5100	msedge.exe	103
PID 5100 wrote to memory of 4664	5100	msedge.exe	103
PID 5100 wrote to memory of 4316	5100	msedge.exe	104
PID 5100 wrote to memory of 4316	5100	msedge.exe	104
PID 5100 wrote to memory of 1376	5100	msedge.exe	105
PID 5100 wrote to memory of 1376	5100	msedge.exe	105
PID 5100 wrote to memory of 1376	5100	msedge.exe	105
PID 5100 wrote to memory of 1512	5100	msedge.exe	106
PID 5100 wrote to memory of 4852	5100	msedge.exe	108
PID 5100 wrote to memory of 1756	5100	msedge.exe	110
PID 4852 wrote to memory of 3892	4852	GearUP-3.2.1-win.exe	111
PID 5100 wrote to memory of 560	5100	msedge.exe	115
PID 5100 wrote to memory of 4408	5100	msedge.exe	116
PID 5100 wrote to memory of 1848	5100	msedge.exe	117
PID 4852 wrote to memory of 3948	4852	GearUP-3.2.1-win.exe	118
PID 4852 wrote to memory of 716	4852	GearUP-3.2.1-win.exe	120
PID 716 wrote to memory of 3472	716	launcher.exe	121
PID 3472 wrote to memory of 1056	3472	gearup_booster.exe	122
PID 3472 wrote to memory of 3732	3472	gearup_booster.exe	123
PID 3732 wrote to memory of 4740	3732	cmd.exe	125
PID 3472 wrote to memory of 3864	3472	gearup_booster.exe	127
PID 3864 wrote to memory of 4220	3864	msedgewebview2.exe	128
PID 3472 wrote to memory of 1924	3472	gearup_booster.exe	129
PID 1924 wrote to memory of 2340	1924	gearup_ball.exe	130
PID 3864 wrote to memory of 5296	3864	msedgewebview2.exe	131
PID 3864 wrote to memory of 5296	3864	msedgewebview2.exe	131
PID 3864 wrote to memory of 5296	3864	msedgewebview2.exe	131
PID 3864 wrote to memory of 5312	3864	msedgewebview2.exe	132
PID 3864 wrote to memory of 5348	3864	msedgewebview2.exe	133
PID 3864 wrote to memory of 5348	3864	msedgewebview2.exe	133
PID 3864 wrote to memory of 5768	3864	msedgewebview2.exe	134
PID 3864 wrote to memory of 5768	3864	msedgewebview2.exe	134
PID 3864 wrote to memory of 5768	3864	msedgewebview2.exe	134
PID 3864 wrote to memory of 5868	3864	msedgewebview2.exe	135
PID 3864 wrote to memory of 5868	3864	msedgewebview2.exe	135
PID 3864 wrote to memory of 5868	3864	msedgewebview2.exe	135
PID 3864 wrote to memory of 5932	3864	msedgewebview2.exe	136
PID 3864 wrote to memory of 5932	3864	msedgewebview2.exe	136
PID 3864 wrote to memory of 5932	3864	msedgewebview2.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.gearupbooster.com/ru/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffece17c188,0x7ffece17c194,0x7ffece17c1a0
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10644577382124416999,17755646272401051290,262144 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,2562790445623983801,7777592849692317412,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,1826428012125215620,1294343279022832562,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2034280859071366679,9500579389282724384,2097152 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17033757806803456784,6522623312821827120,2097152 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,10419580528851568309,15258794614051389081,2097152 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,18389832777279415980,9281604546101810973,2097152 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,6155400417801983029,9198366347839995775,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,79291791145859973,4740325295660264165,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,8593512251095016400,798752971999858514,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,8593512251095016400,798752971999858514,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6376,i,17931124796543970105,17740017469179066797,2097152 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,6505583966870451820,3619472691863966022,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6672,i,10673890427161318258,16894331454348444536,2097152 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,10112930169260109366,6200622667861696351,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1512
- C:\Users\Admin\Downloads\GearUP-3.2.1-win.exe
  "C:\Users\Admin\Downloads\GearUP-3.2.1-win.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
    "C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUP\" -aoa
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUP\gearup_booster_temp\"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3948
- - C:\Program Files (x86)\GearUP\launcher.exe
    "C:\Program Files (x86)\GearUP\launcher.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶ち㈰㉣〹昹户㌱〵〸㤲〸琀牥朮ͥ⟿瀌฀耀
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Program Files (x86)\GearUP\9270\gearup_booster.exe
      "C:\Program Files (x86)\GearUP\9270\gearup_booster.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶ち㈰㉣〹昹户㌱〵〸㤲〸琀牥朮ͥ⟿瀌฀耀
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3472
    - - C:\Program Files (x86)\GearUP\9270\crashpad_handler.exe
        
        "C:\Program Files (x86)\GearUP\9270\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lanplay.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\c3e97a5e-2724-44d1-5249-88b38e099d41.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\c3e97a5e-2724-44d1-5249-88b38e099d41.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\c3e97a5e-2724-44d1-5249-88b38e099d41.run\__sentry-breadcrumb2 --initial-client-data=0x47c,0x480,0x484,0x458,0x488,0x73805160,0x73805174,0x73805184
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1056
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c wmic csproduct get uuid
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --lang=en --mojo-named-platform-channel-pipe=3472.3848.6314430107054041437
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3864
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffeca9fb078,0x7ffeca9fb084,0x7ffeca9fb090
        6⤵
        
        PID:4220
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
        6⤵
        
        PID:5296
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
        6⤵
        
        PID:5312
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2280,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
        6⤵
        
        PID:5348
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        6⤵
        
        PID:5768
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3900,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
        6⤵
        
        PID:5868
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4052,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
        6⤵
        
        PID:5932
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4208,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
        6⤵
        
        PID:5960
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.2.1.66 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4364,i,8705401684388019661,14171891428941121085,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
        6⤵
        
        PID:5988
    - - C:\Program Files (x86)\GearUP\9270\gearup_ball.exe
        
        C:\Program Files (x86)\GearUP\9270\gearup_ball.exe /main_form_wnd 721468 /show_flag 0 /pos_x -1 /pos_y -1 /version 9270 /client_id 6aa002d4046e760d88697e7d /gray 0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1924
      - C:\Program Files (x86)\GearUP\9270\crashpad_handler.exe
        
        "C:\Program Files (x86)\GearUP\9270\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\c81fcfa9-ab06-40d9-bdfa-b13a1c93eb07.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\c81fcfa9-ab06-40d9-bdfa-b13a1c93eb07.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\c81fcfa9-ab06-40d9-bdfa-b13a1c93eb07.run\__sentry-breadcrumb2 --initial-client-data=0x48c,0x490,0x494,0x45c,0x498,0x73805160,0x73805174,0x73805184
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2340
- C:\Users\Admin\Downloads\GearUP-3.2.1-win.exe
  "C:\Users\Admin\Downloads\GearUP-3.2.1-win.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4870650197839521397,18411560564735886000,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,6485954475896859843,15314791573474518027,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,18181408332862121140,8740432956264982713,524288 --field-trial-handle=2248,i,3827480559236989009,1841282810170018861,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCR100.dll

Path C:\Program Files (x86)\GearUP\9270\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\GearUP\9270\WebView2Loader.dll
Size 113KB
SHA256 4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c
MD5 999f67ef1a2d06beeaf85ec9b5d5d73d
SHA1 644b1768f8675b29fb53a51edb5d344fdf55946c
SHA512 6399fda1c54bd26ce82b7d48ac1b7c9741d5abf68a67bd62ec53ea2a1f82caac2e9bfdb1cb22f5af3c8ca6f4789a888f6519e02941f6c33f6f9d3b0e58eb56f4
SSDEEP 3072:OnbFYqJx7sXRq2KVs9iiamgqeNZPTj7EtJlAlHJcgf4fm9pS:OZYqJx4gkYiavEtJe9f2mbS
TLSH
T130B36B5176D08072E9BE0A380874DB655B3F7960DFA09DEB67845AA94F317C0CE34E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.dll

Path C:\Program Files (x86)\GearUP\9270\browser.dll
Size 38KB
SHA256 9c25f4fa25116542a9c16d94ababec450c6184c6e8bc3cd90f3d9dc4ed5bcc39
MD5 1360c1d67a865ba1f6085e2246f42677
SHA1 ea3eca123552859a8ef4bd0c2db133acda97c300
SHA512 64c290db722c28cd613cf0674d0fccbc54b1b9c5338b59cecaa2cea1d78ec061793b12eb2289d9b901f84b91fac85b9a6f974e3ca751ac31f788d859a7bdae07
SSDEEP 768:W2S9NVky9us6E7y9AHCvQm0OfqodafH6VV4abtkYiQr4:V8NV5eE7ygOf8S4Gk7v
TLSH
T12F0370074908C8B6DE48193B39A455175E9CE7B627A08CE3E792C0987FE3ED63D761C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files (x86)\GearUP\9270\crashpad_handler.exe
Size 853KB
SHA256 80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150
MD5 5a243339440082631749f4bdff283bf5
SHA1 4c3512320b1b3c05ce265037a37aa3f16d3cc57c
SHA512 c0b889a819ac5cc6904caeb37e504e6a50d33e49a0e6fb6bdaf8e372190c9bca021017103a7dfcedf7e2c8d9c6a1f3eef103cdf389a5f6bb9ff71f03783ebe24
SSDEEP 24576:CLblY9+TeiDrZAdMgz3QZ5qY0xTHeMjoOvQdp89T7a0DPafB:0l7xKWnqY0xTHeMjoOvQdpCT7a0C
TLSH
T1F0057D307E1AC135EE5201F389AC6BEB81AD951A8B7706C361C8576D6A742E33F33917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_wer.dll

Path C:\Program Files (x86)\GearUP\9270\crashpad_wer.dll
Size 36KB
SHA256 e4a2295cff0949d9f0a646f36d7fbaa40fefdbf5958d21b091f95d9c96c345d5
MD5 e161e5dd4c57dbb72ef46cd60ac7c8b3
SHA1 7889c0cd22720bb76195bb8de0b77ebcc8068d57
SHA512 d08200a5535cfafac52a0fc16b5512863d6d8d70514bd8cd3324451c47cb5cd5d5592c3ac1440308f52d4142c1551a891a1d4ea7332159b2f4c5bd249b6fd100
SSDEEP 384:U2DgZd8t/u9aQZjkfXUEHQIYi7caPxh8E9VF0NyUzDUf:U2DXt/uLKsu5Yi7BPxWEiEf
TLSH
T1D1F27DA68D242D23DFDF4A74B0E449764E7466005FA180D3732EC2994F993C3BBB916E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcount_wapper.dll

Path C:\Program Files (x86)\GearUP\9270\fcount_wapper.dll
Size 675KB
SHA256 1769c0dae8f211b33784be128c778d8753f71dea28874d0a3034622f4ce00f80
MD5 c59ee7906a64069f8b63dbf86b9bddfa
SHA1 2b7fb8ee33125eaf36405f87501e54bbee90ffef
SHA512 b1b4b7759256689faf52832330b56c331824d131fa847feba501320f0c6ec3a89a4ebec8f9401f5596abb4be7a4cc419bfd799c8bb031a043af13359ad5fa999
SSDEEP 12288:AcjH+4SKRvLcAG6UXoakH8cmC0yNDZTgEHx:Acj+4zJogUXlEX0yNDZ1R
TLSH
T1EAE46D209640E136F8BF0076DC7D869E605C6B31076444DFB7C8AE5AAEB66C1BB31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_ball.exe

Path C:\Program Files (x86)\GearUP\9270\gearup_ball.exe
Size 2.0MB
SHA256 38cd51b2f35f5955ca520285f87db7ecaeb671a09c4f34703f12568947660a29
MD5 87059251fa12108bdb1ca7d692484e1f
SHA1 95789c8d9373d50f7c9edbe3e6b5171e0f5a0d5f
SHA512 09c31eeea3e442649c36afb41667715cb64909ddb37acd7cf26a322a4f6937b560edfa1d64093324381d438b2a9c6b3b855d9c226cd1828e472998506b655f29
SSDEEP 49152:IZ2JDFE4vXlfiP4Dy74xepklwMA0do7yBmB:42Ju4vXlfioyMxxlE
TLSH
T1BDA58C02AF834476E95F0A759EBE573EC638AE10033485C3D79F3C6568716E26D3A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.exe

Path C:\Program Files (x86)\GearUP\9270\gearup_booster.exe
Size 10.1MB
SHA256 349951aeb5241932b652fd61f163e902d37af68e4220dc7cfe7c5b3433200aaf
MD5 c7ef095d0a4f1522d2063154d3839fa7
SHA1 2ace07de9f65bc95152d13c42c84a7924192aa73
SHA512 53db7145a775d0c884e0f9127acd89df19502ef86315df72b1db62e70a4c52becb5bf8a20af4b45c1b99c5168dcd2ce9d2fea206ededf74c5d1da91a71a6be95
SSDEEP 98304:9MoNIC65/8vcWOTb7GPurW/hDlGZiGj45ZIfWUioM9nHCbj1p4Yc9JhCcvqpdyOe:2NC6CMGPwWEO5RCH0hCcvay
TLSH
T142B64A14BAB2811DF8F715BBDABC991D843D7DA1072C90C7928838AD64A2DD67D30F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files (x86)\GearUP\9270\libcurl.dll
Size 5.5MB
SHA256 028dfda38f9aa9bbed5ca3ef6a67cd66ea5e44d68b7781d9717b35b138115fe8
MD5 745b206e518eea5b73bfed7631ccbc9d
SHA1 4422c68c5939833a5fd6169f7c05fed2bfec6f7f
SHA512 8406cef16c550e995fd1e744f59a8fa2c557e9eccd4de6e6ccbecc317fbab46f601f0280ef2b53daf6e3b37b320888443738b3336467146157e527501b07f02a
SSDEEP 98304:0cGYaW1dJbQbLC9b00oA9/4uAxCarTSbcV5:0+aiZoGTH/+xvmQV5
TLSH
T15B46AD17FF8266A0E9CE427E12FF6B7F4D3A5A18972494D38A5128E8C8716D1733E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lunasvg.dll

Path C:\Program Files (x86)\GearUP\9270\lunasvg.dll
Size 484KB
SHA256 6a6991d8d36530b566c98324db4fce30fdf834f9db6291bc1f27443d4d280c56
MD5 5b4fd4e5171e635a0adbaf46396c54e2
SHA1 d2d10ffe8a85f28b35071a327a053543ce26a230
SHA512 dac6a5ffba6c0ec46086309bd4feb7b8f90d22c25e8081fc6089d78f89b2fed98d8f50aa586ab6e4a23eee11c05fe4ef57215ca92a80b913467f1aebd56df500
SSDEEP 12288:E6JcA+NdGkkSEvhf2g1LKYH5HMHt/yGdC:E6JcA+pkSahf2KLKYZHCtd
TLSH
T17DB4AE32B822C271F9D912F1F9BD6FAF55396E2007AD4AC367C848A5C5609D367B3243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Program Files (x86)\GearUP\9270\msvcp100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\GearUP\9270\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ping.dll

Path C:\Program Files (x86)\GearUP\9270\ping.dll
Size 1.5MB
SHA256 57ae94d879d94101f4ddfaf86d38aaf5e32b5b02a6f6f549a0f2657b44e35961
MD5 dc37277222d7cc1e51731779a16f564c
SHA1 b0f14fc69d4f6b2ee57072aef414db53dc0a63b3
SHA512 69905759f3e268d09048a1eabc59042bfe362a337994d081562c262a817e4113d18eb6b350fe2a88fc80789cc9428f4146da982a7c3fb436ec01044b2d5ed199
SSDEEP 49152:qEl7DpPb/gX+0WrvlC8lPpkVQU20wCwed:Dl7NgX58fluVQ3Q
TLSH
T16475CF03FB8644B1E94E0B3963B7A77FAE359A008324CAD3DB603C5598716D1A63E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Program Files (x86)\GearUP\9270\sentry.dll
Size 426KB
SHA256 4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05
MD5 bf9002bf5c878cdca749025a5f875d6b
SHA1 e916d3121706dbd1ada335b414e4601373b86ef8
SHA512 34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20
SSDEEP 6144:p7HglxMmuzFL2PHajb28r4A/Y7+E/P1cVYr9BeVWiOYaGXQB+r7eY:p7HAx3IFL22707+oKVejeVWiOYaGXQK
TLSH
T13B946B313E15C275FEDA01F6E8FE4FEA896C5965473A01C36AC826957A700D73B3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.dll

Path C:\Program Files (x86)\GearUP\9270\skin.dll
Size 13.6MB
SHA256 ad38e920f24e38c5f4d797be4c18e7cc84be50df9fdef8b0d3bfaa283ce5031c
MD5 176ce33cc8e4c77327dc24a16a58a3d3
SHA1 4a97d108ec7a81576858e11324deecc25fb8e856
SHA512 54fa2516b6dcf45e53a41b4024c4bb7e895c514d3133d35a90e2af7a938225062158fd4e53904f54238c7d04c79aa4aa2d7ad489fa8498e9bceffdf8c1c89ac2
SSDEEP 393216:pa97pJFMxBh348rsR8WypH2wLJnKt1Jd6NgNfJ:paU34w5nKjfmyR
TLSH
T19EE612E3F327A994C62B5F352CF75690B437F67D8F21310B6420E6A1ADE3AC14A86345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.dll

Path C:\Program Files (x86)\GearUP\9270\ui.dll
Size 1.2MB
SHA256 2dbabc6f6e9ce03d4bb5eb8bc8ba5168ccf9dbbde8c84ddb02e9929687a2ef28
MD5 2311c09b86c1d42919310ab85aadf86f
SHA1 f66075f449c76543b06063461aa1666715dd464b
SHA512 dcedfe965864c9b5b581a2763df1a2c5a33c446b2ef2248afdd83477fbe9653dea317e44e7461ef175c2ec039c8826b7dacae25bd50fbefa1379285e71945254
SSDEEP 24576:gsiG9UBQQUNYdBE9AqFZjb8t1RVqYsJ4GS:oG9UBQQUWBE9Ar2YsiGS
TLSH
T1F95539702E9581BEEF92D177CE3C7B6D24AD92421F2442C371DD0E1D6D624E39A326A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui_webview2.dll

Path C:\Program Files (x86)\GearUP\9270\ui_webview2.dll
Size 238KB
SHA256 dd983e65318b3290574daf8309c53a5706c9f744f4efbcc2fdb44af43cc5cce4
MD5 0cd8b64f29171ccb509565c5e8c7c2ee
SHA1 12045ac3f825724e1d0abb7930ab1cc7eb7105af
SHA512 4c1baf3ede71658435d8c8cce7a2ea881cd8ce628ac87be28c10f2c82b7d463095da0ccb32c840f718bcc566ce7af14ffb2e7976917e9fcaf7e3f451837da2be
SSDEEP 6144:lT6J+APD6jfiBtqpdAbMQb/wbvb0bxb9bMQbzlbZsZuTCnvsdjWdwu5huAdWuBAX:lT6J+o6jqBtq8bMQb/wbvb0bxb9bMQbf
TLSH
T1D0346C317145C639E7DE02B54C6AEBDA12ADB6361FA1C1C7BBC4DE1E0D222D12B31627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files (x86)\GearUP\9270\uninstall.exe
Size 2.9MB
SHA256 7f81214857b67193187477ac4060fe5edc93547a571bdcd771aa2adeaef34e40
MD5 1fe91b3d4e0ccfb8fc19ef477325f6cb
SHA1 d87f703b20d359e51bb9ea318e87684ad88a383c
SHA512 55d9a91b7b0ddc5fff33d54651e2250db5de15fc3a35599b67fbd3d1860a4724f27cb729941daa82c531751bc1515fec4f22c70d79b630c25694b515e1ced155
SSDEEP 49152:cSzcuw0CYD7Jr9eViMWVZcUjovDP/n8wJUbJMhtmARpk/pMMbRd9GLnCxgvm:cSwYJr9eHQaJUbJM6AE/+M/
TLSH
T1A0E5D012FB868072E567073555BAA77B9935AE200334C5C3F7A53D2C58706D2AA3F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Program Files (x86)\GearUP\9270\update.exe
Size 3.3MB
SHA256 ba93a78c7cdf88b7c6f547c0a5e9572067890c0e71b3dae6b4e18a5c9d5bd40a
MD5 a074a0cdff03d718419328a0fde9e572
SHA1 7ea4b43121ddd0874a1eb6084c2b7bcd0388c14f
SHA512 54748d7c2ee24d8ffbe2c18340017871df424148852c54c141f3f507d5213b132ebe632ae33d105f684019417c061b7dc5baf708d75bd9b8c05af36f609efc24
SSDEEP 49152:3xzWxg94peo1jbbr/5uxCRyT863YeYxLMPCU8ViccUpkCw1CRT+zCcQQKku4FA3f:309F7yA63YPLICUMiccbFo+emKp4ji
TLSH
T1F0F5C012AE878072D55F06745DBE97BBC939AE21133485C3E7AF3C6C18705D2AD3A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\GearUP\9270\vcruntime140.dll
Size 88KB
SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
MD5 81b11024a8ed0c9adfd5fbf6916b133c
SHA1 c87f446d9655ba2f6fddd33014c75dc783941c33
SHA512 e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1
SSDEEP 1536:ckch/beb1bBhdXPFSAS7wIVktX8/eZT2G//ecb2Z0X3I+zl3z:ck2+1blXPg7wIVkts/UF/ecb2a5F
TLSH
T14E937C02B5D48071D9BE18B643A9D6027A7DB3A14FD60AEB5FA59CC89FB57C0E730207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\GearUP\9270\zlib1.dll
Size 77KB
SHA256 b9cbdf114c7c403d844550c12d7dd8c755cd58b5b4f99135d812bafd444364ac
MD5 e3523734f05af14a7b74bc026e3d31b1
SHA1 bc54a7b2adde2004903840ed8279e8b975c67fc2
SHA512 1c81bf56978e86299fa21573e6a6cfe942b7289ecb8e7ee4b1a67af3639d1b45d4274f00f35a0cff4d0e75da420e9fce4183ef439ff9cc62914f3df563a27104
SSDEEP 1536:z77FCOWzicqQPFwYZEABJx98se//002UldXfyIOsIOpcKjKr:TFlWWQuaEsJ0JbXfQipcKj
TLSH
T113739D41AB9143F5D4F5017681F7472DD63630208B87ECEBE28DB6E988127D1AB362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
Size 589KB
SHA256 0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035
MD5 c6d72642721e84d227defc3ec4ab12e6
SHA1 3709a7c3cc795a0012adc6ccaf82a93628703518
SHA512 fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389
SSDEEP 12288:qwW5Af1q9Wq0/rxaxQhlS/a4zdFGDyV+LrnYkdcmE1GN6:qwWO+BElQa4xFGe2rnYkdcb1
TLSH
T1FBD48E133AF5C0BED6620530CA1E6BF5A0FA97680B2248C767D08E1D1B798D5C636E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.zip

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip
Size 28.9MB
SHA256 5f74a9f8d5ae2b14549d397386d9ffd1bf608a13232105f8591af5757ec8be5c
MD5 25ca8b318fe21b22be49842f3a0914e3
SHA1 3c6b4c00cfbe2e5172f9b6e45b8af465c5b28a45
SHA512 6728d67336c95afcaadeaeef35a23348136a0b8e65b7ecdb0b16fd252ce1b6455f1ed4f6320d00ae442d8f29df5c0b6f641742ab693de14d40a25c4990bef3c5
SSDEEP 786432:0N/5mZlgkyVPsUQQUJIPu5Y5WPEzncmLp9A:O/57k6EbXWkPWL3A
TLSH
T161673365BE244A858C13307336B68D9B23990DD242EBAC0BC8F6F17B814D6D6E597D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files (x86)\GearUP\launcher.exe
Size 1.7MB
SHA256 6fd82fa9476600b5eb73058360ab6844781f7c182807d90391c2097987a8ee83
MD5 c1bd9d3b2ad68ed64221e341a39e1345
SHA1 8cf5f468391999ef1f07f2217f1250bd5f2a7e53
SHA512 a716ad1bef1209124a8743a8560239ee381cc8b4380563a938bac0e004804a72521f3e5ed7483eb8c4831b31620d06f34406a5d335e79c481c2cd9a6d6df0acc
SSDEEP 49152:z4JmPG4iH+/3/s9JB0dY/VYTpk5WmcSdHZp:z6+/3+v0dkYykmz
TLSH
T17985AF02BE8784B2D84E0A399DBF977FCA35AA114335C6C39B5F3C5458212D25E3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e398749de278755833faae4696b162e4175d618f5b98cd12951da0d88c785c1c
MD5 eab9f921a9305e1372902cb4fef7d940
SHA1 7774908518f5d00fc5cc5d0043c5dc1694073ef1
SHA512 be8f7149d925474daf603763ea26cf807ac8911335f4c0a067f7b276e3632026d62a9910662c7583495d8b6fcf7b543af14ea1397a890475fe7552166da6c1bc
SSDEEP 48:ozfRs2s9Bnk2aW+hcY4sLJpHhRckr1y5t1PHJyIYLqICMKTaeBjzP+Vd:+fa2sTzTY4s3Dy5t1PpyIoqbaeBn+Vd
TLSH
T1EF91B4AC85D26725E7C12232F8DD384B30B3D49A0A17BDEB9BC4C87D5F0239D4A71088
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c3e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c3e7.TMP
Size 3KB
SHA256 826da0ff5fc59153adbf5de31c014da8d8fa4cdddfb43a3cc189aa6904e65d6b
MD5 b980ef39142bee9abc051db079272db9
SHA1 48801ef3d1c729a9d7715f75c5d2ebfdf5f2c6e8
SHA512 a11dc6e1992c9c213bac51df8b816b38c72edf15220e7c0a55b71c73ac149bdf551b3a61a3298fbfac73617a3d69a2b60a524e195d608200af4b6d743a3ea5e7
TLSH
T17671D81C05E26B05E7D23231E0DD790B3571E89A1A2BBDE59BC4C8BD5F0671D8E7101C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 703ea42b0e993224e2a7f704902640b09960f19ff6c528f73365de8939302290
MD5 386267c873c2bfb30607f9cbec6923a4
SHA1 072bb982d08dc6ea61e59038f7cbe0bde708d994
SHA512 24b4fd5a41e1edd063628ea8375edd8646babae1e82db3938dafc5354052511bfd87f84bff3236fc5f956a67d31d405785f0cefd7c4416dd147d8e61ad340d5d
SSDEEP 192:sxZHRD1yM/jK1Ml8M9D/fqs6poyCIdpihHW6+WNM0l/YwMq6tIgU6J:sxZHlJ1D/fqs6poyrGHbl/kU2
TLSH
T15F52E8116A74697BCCDBD309FA45BB53D6F51472A2900E44ADFCCA1C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1a75266a45610fb61895cdaf06895b949b0535ca1d370c08afd0a9b51bd38957
MD5 a7b7d0499d3d7dffce6419f5ed60b09d
SHA1 a00853770dbf65a0fb99f153bc6e37d7d65541ef
SHA512 b2d2fe9f9b6b5bb45cd99fc5192776d746b22d021142ff37ac8b035b1393e36f314da1cfe20fd60d4feb00194284347ce52c8b61ae9ebf9d4ae7d19adbe74170
SSDEEP 768:rg4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dyCrohvWc4ae:rg4jeXmWvmKLEu1jacPLZQdyZD6
TLSH
T110D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bddde23d8384d809d16637d74df0dfd39a1738635f7e7506098d4578fd96b8e5
MD5 25e24f1d66a3341409541888babdfee8
SHA1 01f54ecf82e9c36dd1dc65e7f7539af5105987cf
SHA512 d4df047f9e6061194678e93b5ac557cf9ca8d7f3df343f6ea2be92aef1511982e0289530efe9b3ff9fa5a2527cef6df97d98264f69a8187d992fa2a13ce60804
SSDEEP 24:KdXfu1Mapdddt45V+AIjptKiahant1E/9SmHMC89WyXYOfhSTaAdUws4EQ+3IjWt:Kk8I3KJ2UTyFDIFKMk4EJIZKS8s7ypz
TLSH
T18F915502747706412DBE650892A4A76B5B427663312DE52B3FA904B28E6FE390CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2eb12a62650326a181a519b77b17a11716308dee171f220c28479c8f4376d466
MD5 fa31fc426ccb4b99593d9bdadc85dd5a
SHA1 35f75192351d33a436a69f54650535c446f56db1
SHA512 8863f324a89a2c0228e63e969b65f2d04ef72856344c2e2dfa598b7afc9398bf9ec1e0f60f53cede03558790a07bd65a019e44a5e7712190d4c2009489824b2d
SSDEEP 192:EONp6hZ0QmiUyTlpc/+jV6jzorkZk5wOZ3xU6:EONp6oypu+w8kZb2BU6
TLSH
T16202D935A8686CB78EE2AE45F48737135FE5112BADA56F84DAE85B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8030b6a190ce59c1b461b32bc596e129a084e3b49197578c1bd208a58d5cc3db
MD5 b161f8224039a53f70f999ee6966772b
SHA1 4dd76c74a68f212078bf1262cd9f41c34bfc1d99
SHA512 19991c6c6cadb1650dda59231c7b5ebc8e912d82df9101266ba2f50d5620a56daa5025aa84dfc9388083a4af98fe82021723f43fa6a8575ffc39b1b3c245f0ce
SSDEEP 384:TZcIfsNG5EBwl/VRDbmS2f+w8kZyXH+2iFqsa+VYDG7ow:LfW+ISmbKHl0qhg2QT
TLSH
T151826D326DB4AC7758E7E381F54722138EF8A06796D9AF84D5EC9F0D00DA6AD1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 60bac432827032a141c20c4f07b078a1ffc5252c1b981697b154fd6159de3b40
MD5 473776812bcfcb2ed0b5603f054e67e3
SHA1 3c5336017a9a7b89be137421c913808ff1af12e7
SHA512 9a0801e44fc5f125d696ad22e72c327980129511007cb5502ce355c6ea74a980762708210bf374afd4a25acd21fec46eaebffa5340674e04337b144cb9ff6ecc
SSDEEP 384:MZcIhsNGcEBwl/VRmmS2f+w8kZyXH+2iFqsa+VYDG7ow:ahl+NSmbKHl0qhg2QT
TLSH
T16F826D326DB4AC7758F6A381F54722138EF8906796D9AF84D5EC9F0D00DA6AD1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4896251b785c90628bae3e4e77f2f70f0faffc123b01e26966f6182a471d6658
MD5 5aaa9bb962de1b78c7a6191d95465387
SHA1 27c2f7a6574fbfb3336968b1ae8258e3865230e5
SHA512 c085e7a7f681b38e583fe0de9035841f0c5feb66dda92e1d0d9a65cb5d2ff64ff0face43a02b3aff5aa7c376351c0565fce07ffd76610224b5fc421f0cfeaa6b
SSDEEP 384:XZcIfsNGQEBwl/VRDbmS2f+w8kZyXH+2iFqsa+VYDG7ow:ffV+ISmbKHl0qhg2QT
TLSH
T18F826D325DB4AC7758E6E381F54722138EF8906796D9AF84D5EC5F0D00DA6AD1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5626260ff0946f7a2c1e01cfdb03b65f6419c40ebc6cb1da45bd06b80b024ca
MD5 e9bf7de8a594b8219980ab1ae1fcc51c
SHA1 5474e16046db86d459a3e70515680ab4c3348bc8
SHA512 942de82f0108474c2da002599929a1e7da4b933c21677f06c15ca67d3cd7a22a7ba987a0576575cc149e5fa91fd04b40e870544f65485fe7f1c4bf9a22c60254
SSDEEP 192:UON/6hZ2QmiUyblrc/+jV6jzorkZyXH+2x5cOq4qsU6:UON/6maru+w8kZyXH+2U9qU6
TLSH
T18E12FB36A868AC674DD2A655F48732239EE55127EEC6BF85D5FC1F1C00DF6AC130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63504815-91fa-4218-8bd3-29db56e47c8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63504815-91fa-4218-8bd3-29db56e47c8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6ac9932ad7837cb4ac6d4e23e69a16bab82c2395c69b8d70d585e43f6dbd8daa
MD5 9e15f17cad1a07f487b7411c14f99ca5
SHA1 7c30d249358b5837d88feb2e2774121a0fd2c9bb
SHA512 b6ed2dfbf5f5b8e4eb1764428cde83a984335ba012d215e1ce87862b36654658179ffee8190d8549368f9d97d63ac87104f96ddec0f5fb9d543c02d5221a5e1c
TLSH
T1D6410B58AAF91148B3B76E56ABF6A86D447EB8732F06D45D10110E4F4723A40CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

gu.log

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
Size 210B
SHA256 4e7465f32e52a76236a19ea626ec2c1918819f78591c2d42a4fb828b8d04bde7
MD5 0b93bebe4f338cbb09e43ef0dbe10f74
SHA1 0066b29740fb12768368235015b94a1fc50daf82
SHA512 be8c3f2f84059542c51d33870903ec83f17edbac09f193c497d797322f10d7e1c8a62c99fba3aa87d517914209ba535efab506daabed04a668fedd7018065517
TLSH
T1FAD0A79A888053415A6FD77994652B1884910968475FB050114E1BFB9292461F240842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 83a9e82b23ea03e2ac2ac5c6c9460a54a5f5e7840cce26046d9b1f8f8227e4fe
MD5 6ce94a834dd2dd68aeb5b9e3900faff7
SHA1 6756d0a7da57356f8afec0d1ab070583e72898e0
SHA512 08026c897f4efb126ae08cbba07208a7fa2fe714fa5a9889df595b30f68556814a84b4a2271911db69bb735b916e5b0e669bf070b36e8221413ac44b7aaa9614
TLSH
T197D0222F3302A2B8C02232330003FA8E0800CA0F800B8030AC3CCE2E2F888B00E038C2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 1KB
SHA256 723898d9de5e0b7ae499ea1d8685c5dbf693bbb2aece3213e5543fdb06dc5016
MD5 d5c42efd0c836db01c0d4ce83ee045b1
SHA1 9f72c319a46c88b48b46abdcc4228db9cb3738e6
SHA512 4ae5a20bfa1d7fa5cc6b96d6afbe255fb0d3a1a5a2e1a470dbf16dcf86170ddcb76ca3468c2dd4b9592055dea8be3d20567a51c9c9572ba6d4926e827d3ae798
TLSH
T16B318573F0943B725DCA6B89B2476A47AE20705390128F4495DE4B0C02EB5DCEA7BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 3KB
SHA256 8ffb676c54bc59116341dad2f7c275fdf304061a4afb90fca288e1a054a2ed65
MD5 aa3fd6c2a0310d97ba879a987e4555e0
SHA1 e365889a2be4280a54ccb79802eb5ccea01ea867
SHA512 559d4d11c9bfa447fdfd842e976fe15326441e3e70c596d8fdcd0a1126d45a3964a888b57604de02577c7c0786a6e6b4c56405286e30d6a6f99ab8e2cd115848
TLSH
T10771A737A9A4B9374DE79E48B9862B06BBA16023E5957F94C9EC0F0C01DB2DC2352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 2KB
SHA256 1c27ee5923faba8f4d5daafbc8735c591542a858dd931ca3ef7e5611fe536d73
MD5 db8b0d58ce9b7e2c36b7d6b4896484fb
SHA1 e1d9371bab09919c6eece319400897b61fde03e9
SHA512 d88bd19124d5703c0cc710481d7df936ef5dc88c7c60474f04924f83382920618fc57187472a16406bf9a0da7a1b19051557deab6bf722309bf36ea263d735ed
TLSH
T14351B433F8446A3789E79B88B94A3F13EE31706299622F9089DD0B1C01DB5EC2713C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58fab7.TMP

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State~RFe58fab7.TMP
Size 1KB
SHA256 4b550c7b1ef8382bc65f9f14dc4d92b6920bc4256d14c21cda456fc23c2f854e
MD5 c6058232af5bb4978a5bdceaf84b8c1f
SHA1 01525f239bdb10454af6f1177bce13259bf99990
SHA512 747381b39319acd8576d08ee172709961e25c7cb68acc7ee6b745c91457b2dd175f7ca5adae29b89d1d35d0c4bd973b07c4149698b3ac464a6ce3b1f3852555c
TLSH
T151216533E0983A76698A5A94F2036A4B6E60605391159F04D4DE470C02DB4DCDA7BC33
MD5 SHA1 SHA512 TLSH

Submit Download

GearUP-3.2.1-win.exe

Path C:\Users\Admin\Downloads\GearUP-3.2.1-win.exe
Size 35.7MB
SHA256 6677e5f9e76475c2a22389f189f6e7b4d03e1690b69125841f86a902341e9457
MD5 9b3547b8c7eec6e9d591d97bf2018dd6
SHA1 d4147d0092b20c29761ff18a9d376898bd061bb4
SHA512 681af622cd613d321536eadf7430e085aae51a903a79e8d88f409662fa6ec89a9be5edcfb46fa608ef51d4c815ce71516e6bd341f0ff5932728ace265ef94b28
SSDEEP 786432:Ar6GBEIrN/5mZlgkyVPsUQQUJIPu5Y5WPEzncmLp9j:OEO/57k6EbXWkPWL3j
TLSH
T1CE873312BE928072D45706309E7E9BB7C979AE20133185C7E7D97D2D18346C2AE3B35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4852-357-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/5296-764-0x00007FFEE9090000-0x00007FFEE9091000-memory.dmp

Download

memory/5348-816-0x00000240085A0000-0x00000240085A1000-memory.dmp

Download

memory/5348-815-0x00007FFEE8AF0000-0x00007FFEE8AF1000-memory.dmp

Download

memory/5768-853-0x00007FFEE9090000-0x00007FFEE9091000-memory.dmp

Download