cf4823a2153c3a6eefc800c7fdfea8ce342d07f2b064348385ec11492b9f859b

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
77s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GearUP-3.3.0-ankol46.exe
Size 35.7MB
Sample260930-nrbfkatgrd
SHA256 cf4823a2153c3a6eefc800c7fdfea8ce342d07f2b064348385ec11492b9f859b
MD5 ea7b30ec36c0703f22f349f04ea39af2
SHA1 f39b96e4619ab1fbf4dba7560ad60d0a6ef19d08
SHA512 6ad223835cc2cf7ed56f8199afbef3d3748d30ab53a80384c0a4c721a0449d0276b46e29a156d14949298aaaa40b919db5c7291ff2aeb3cafbaee175dcc83c57
SSDEEP 786432:sr6GBEIeky94UL7kslO8Tte3JpJvecc5iZnRS7zUJu9yIv6WKQ:CEYULY7OgZfpVQ7zUJu9Rv6WKQ
TLSH
T1E1873302BF938072D56B05319A7D67B6D97ABE205331C5C3A79A3C2C5C316C2993B39E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\N:\	gearup_booster.exe
\??\S:\	gearup_booster.exe
\??\L:\	gearup_booster.exe
\??\M:\	gearup_booster.exe
\??\P:\	gearup_booster.exe
\??\Q:\	gearup_booster.exe
\??\R:\	gearup_booster.exe
\??\X:\	gearup_booster.exe
\??\Y:\	gearup_booster.exe
\??\B:\	gearup_booster.exe
\??\D:\	gearup_booster.exe
\??\E:\	gearup_booster.exe
\??\O:\	gearup_booster.exe
\??\T:\	gearup_booster.exe
\??\Z:\	gearup_booster.exe
\??\H:\	gearup_booster.exe
\??\I:\	gearup_booster.exe
\??\J:\	gearup_booster.exe
\??\U:\	gearup_booster.exe
\??\V:\	gearup_booster.exe
\??\W:\	gearup_booster.exe
\??\A:\	gearup_booster.exe
\??\F:\	gearup_booster.exe
\??\G:\	gearup_booster.exe
\??\K:\	gearup_booster.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GearUP\9271\gearup_booster.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\NW_TAP_0921.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license\jsoncpp_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\arm64\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\fcount_wapper.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\openvpn.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\VisualElements\SmallLogo.png	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\7-zip_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\gearup_booster.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\lunasvg_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\NW_TAP_0909.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\gearup_render.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\gearup_booster_vpn.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\host_fp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\lanplay_tun.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\lunasvg.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\x64	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\dui_webview2.tlb	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tun2proxy.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\NW_TAP_0909.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\shence.log	gearup_booster.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\hostfp	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-stdio-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win7\x32\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\gearup_render.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\wfp\win\x64\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\netfilter_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\winpacp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\NW_TAP_0909.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-filesystem-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-math-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\nw_tap_0921.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-core-file-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\local_proxy.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\local_proxy.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\wintun\wintun.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win\x64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\drvinst_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\gearup_booster_vpn.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\host_dp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\tap0901.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\apiinstall_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\gearup_ball.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\libcurl.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\ping.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\i386	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\nw_tap_0921.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\arm64\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\browser_d.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\hostfp\64\hostpacket.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\NW_TAP_0921.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\crashpad_wer.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\WebView2Loader.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\WebView2Loader.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license\duilib_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license\protobuf-lite_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\protobuf_LICENSE.txt	7za.exe

Executes dropped EXE 6 IoCs

pid	Process
1200	7za.exe
1360	launcher.exe
3476	gearup_booster.exe
4840	crashpad_handler.exe
4808	gearup_ball.exe
1236	crashpad_handler.exe

Loads dropped DLL 32 IoCs

pid	Process
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
4840	crashpad_handler.exe
4840	crashpad_handler.exe
3476	gearup_booster.exe
3476	gearup_booster.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
4808	gearup_ball.exe
1236	crashpad_handler.exe
1236	crashpad_handler.exe
4808	gearup_ball.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gearup_booster.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0007000000024641-341.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4148	cmd.exe
3456	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GearUP-3.3.0-ankol46.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GearUP-3.3.0-ankol46.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gearup_booster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gearup_ball.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gearup_booster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gearup_ball.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GearUP-3.3.0-ankol46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_booster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_ball.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	GearUP-3.3.0-ankol46.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUP\\9271\\gearup_booster.exe \"%1\""	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\0\win32\ = "C:\\Program Files (x86)\\GearUP\\9271\\dui_webview2.tlb"	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\HELPDIR	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GearUP\\9271"	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\ = "Webview2QueryLibrary"	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\0	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\0\win32	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\FLAGS	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{774A5535-6FAB-4844-A67A-323C54A63A26}\1.0\FLAGS\ = "0"	gearup_booster.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	gearup_booster.exe
3476	gearup_booster.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe
2748	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1200	7za.exe
Token: 35	1200	7za.exe
Token: SeSecurityPrivilege	1200	7za.exe
Token: SeSecurityPrivilege	1200	7za.exe
Token: SeIncreaseQuotaPrivilege	3152	WMIC.exe
Token: SeSecurityPrivilege	3152	WMIC.exe
Token: SeTakeOwnershipPrivilege	3152	WMIC.exe
Token: SeLoadDriverPrivilege	3152	WMIC.exe
Token: SeSystemProfilePrivilege	3152	WMIC.exe
Token: SeSystemtimePrivilege	3152	WMIC.exe
Token: SeProfSingleProcessPrivilege	3152	WMIC.exe
Token: SeIncBasePriorityPrivilege	3152	WMIC.exe
Token: SeCreatePagefilePrivilege	3152	WMIC.exe
Token: SeBackupPrivilege	3152	WMIC.exe
Token: SeRestorePrivilege	3152	WMIC.exe
Token: SeShutdownPrivilege	3152	WMIC.exe
Token: SeDebugPrivilege	3152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3152	WMIC.exe
Token: SeRemoteShutdownPrivilege	3152	WMIC.exe
Token: SeUndockPrivilege	3152	WMIC.exe
Token: SeManageVolumePrivilege	3152	WMIC.exe
Token: 33	3152	WMIC.exe
Token: 34	3152	WMIC.exe
Token: 35	3152	WMIC.exe
Token: 36	3152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3152	WMIC.exe
Token: SeSecurityPrivilege	3152	WMIC.exe
Token: SeTakeOwnershipPrivilege	3152	WMIC.exe
Token: SeLoadDriverPrivilege	3152	WMIC.exe
Token: SeSystemProfilePrivilege	3152	WMIC.exe
Token: SeSystemtimePrivilege	3152	WMIC.exe
Token: SeProfSingleProcessPrivilege	3152	WMIC.exe
Token: SeIncBasePriorityPrivilege	3152	WMIC.exe
Token: SeCreatePagefilePrivilege	3152	WMIC.exe
Token: SeBackupPrivilege	3152	WMIC.exe
Token: SeRestorePrivilege	3152	WMIC.exe
Token: SeShutdownPrivilege	3152	WMIC.exe
Token: SeDebugPrivilege	3152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3152	WMIC.exe
Token: SeRemoteShutdownPrivilege	3152	WMIC.exe
Token: SeUndockPrivilege	3152	WMIC.exe
Token: SeManageVolumePrivilege	3152	WMIC.exe
Token: 33	3152	WMIC.exe
Token: 34	3152	WMIC.exe
Token: 35	3152	WMIC.exe
Token: 36	3152	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3476	gearup_booster.exe
4808	gearup_ball.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3476	gearup_booster.exe
4808	gearup_ball.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 1200	3688	GearUP-3.3.0-ankol46.exe	86
PID 3688 wrote to memory of 4148	3688	GearUP-3.3.0-ankol46.exe	91
PID 3688 wrote to memory of 1360	3688	GearUP-3.3.0-ankol46.exe	99
PID 1360 wrote to memory of 3476	1360	launcher.exe	100
PID 3476 wrote to memory of 4840	3476	gearup_booster.exe	101
PID 3476 wrote to memory of 3456	3476	gearup_booster.exe	102
PID 3456 wrote to memory of 3152	3456	cmd.exe	104
PID 3476 wrote to memory of 2748	3476	gearup_booster.exe	109
PID 2748 wrote to memory of 2980	2748	msedgewebview2.exe	110
PID 3476 wrote to memory of 4808	3476	gearup_booster.exe	111
PID 4808 wrote to memory of 1236	4808	gearup_ball.exe	112
PID 2748 wrote to memory of 4572	2748	msedgewebview2.exe	113
PID 2748 wrote to memory of 4572	2748	msedgewebview2.exe	113
PID 2748 wrote to memory of 4572	2748	msedgewebview2.exe	113
PID 2748 wrote to memory of 940	2748	msedgewebview2.exe	114
PID 2748 wrote to memory of 3680	2748	msedgewebview2.exe	115
PID 2748 wrote to memory of 3680	2748	msedgewebview2.exe	115
PID 2748 wrote to memory of 5280	2748	msedgewebview2.exe	116
PID 2748 wrote to memory of 5280	2748	msedgewebview2.exe	116
PID 2748 wrote to memory of 5280	2748	msedgewebview2.exe	116
PID 2748 wrote to memory of 5360	2748	msedgewebview2.exe	117
PID 2748 wrote to memory of 5360	2748	msedgewebview2.exe	117
PID 2748 wrote to memory of 5360	2748	msedgewebview2.exe	117
PID 2748 wrote to memory of 5420	2748	msedgewebview2.exe	118
PID 2748 wrote to memory of 5420	2748	msedgewebview2.exe	118
PID 2748 wrote to memory of 5420	2748	msedgewebview2.exe	118
PID 2748 wrote to memory of 5444	2748	msedgewebview2.exe	119
PID 2748 wrote to memory of 5444	2748	msedgewebview2.exe	119
PID 2748 wrote to memory of 5444	2748	msedgewebview2.exe	119
PID 2748 wrote to memory of 5468	2748	msedgewebview2.exe	120
PID 2748 wrote to memory of 5468	2748	msedgewebview2.exe	120
PID 2748 wrote to memory of 5468	2748	msedgewebview2.exe	120
PID 2748 wrote to memory of 5140	2748	msedgewebview2.exe	129
PID 2748 wrote to memory of 5140	2748	msedgewebview2.exe	129
PID 2748 wrote to memory of 5140	2748	msedgewebview2.exe	129
PID 2748 wrote to memory of 4928	2748	msedgewebview2.exe	130
PID 2748 wrote to memory of 4928	2748	msedgewebview2.exe	130
PID 2748 wrote to memory of 4928	2748	msedgewebview2.exe	130
PID 2748 wrote to memory of 5368	2748	msedgewebview2.exe	131
PID 2748 wrote to memory of 5368	2748	msedgewebview2.exe	131
PID 2748 wrote to memory of 5368	2748	msedgewebview2.exe	131
PID 2748 wrote to memory of 3744	2748	msedgewebview2.exe	134
PID 2748 wrote to memory of 3744	2748	msedgewebview2.exe	134
PID 2748 wrote to memory of 3744	2748	msedgewebview2.exe	134
PID 2748 wrote to memory of 5132	2748	msedgewebview2.exe	135
PID 2748 wrote to memory of 5132	2748	msedgewebview2.exe	135
PID 2748 wrote to memory of 5132	2748	msedgewebview2.exe	135
PID 2748 wrote to memory of 5532	2748	msedgewebview2.exe	136
PID 2748 wrote to memory of 5532	2748	msedgewebview2.exe	136
PID 2748 wrote to memory of 5532	2748	msedgewebview2.exe	136

C:\Users\Admin\AppData\Local\Temp\GearUP-3.3.0-ankol46.exe
"C:\Users\Admin\AppData\Local\Temp\GearUP-3.3.0-ankol46.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
  "C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUP\" -aoa
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUP\gearup_booster_temp\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4148
- C:\Program Files (x86)\GearUP\launcher.exe
  "C:\Program Files (x86)\GearUP\launcher.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶换㑦戹㈷㙦晦搰㐵㜴摥扣⼀⵸睷wࠀ踀佌佇华剅䕖㵒屜䅄䑄卙剅䕖R
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files (x86)\GearUP\9271\gearup_booster.exe
    "C:\Program Files (x86)\GearUP\9271\gearup_booster.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶换㑦戹㈷㙦晦搰㐵㜴摥扣⼀⵸睷wࠀ踀佌佇华剅䕖㵒屜䅄䑄卙剅䕖R
    3⤵
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe
      "C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lanplay.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\c6e8f653-6c2d-4369-4030-05eace52bf02.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\c6e8f653-6c2d-4369-4030-05eace52bf02.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\c6e8f653-6c2d-4369-4030-05eace52bf02.run\__sentry-breadcrumb2 --initial-client-data=0x474,0x478,0x47c,0x450,0x480,0x741e5160,0x741e5174,0x741e5184
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4840
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic csproduct get uuid
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3152
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --lang=en --mojo-named-platform-channel-pipe=3476.4764.18033715206991481307
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb7bf1b078,0x7ffb7bf1b084,0x7ffb7bf1b090
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1860,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
        5⤵
        
        PID:4572
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2464,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3696,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
        5⤵
        
        PID:5280
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4072,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4232,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
        5⤵
        
        PID:5420
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4296,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4544,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
        5⤵
        
        PID:5468
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=2304,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5288,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
        5⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5592,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5536,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
        5⤵
        
        PID:3744
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5404,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5556,i,5719749451756655095,15557809889880578815,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
        5⤵
        
        PID:5532
  - - C:\Program Files (x86)\GearUP\9271\gearup_ball.exe
      C:\Program Files (x86)\GearUP\9271\gearup_ball.exe /main_form_wnd 721368 /show_flag 0 /pos_x -1 /pos_y -1 /version 9271 /client_id 6abcf4a7c2d65111c8377bc4 /gray 0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe
        
        "C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\87ed17ab-bdb9-4329-8026-3d063b27ac84.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\87ed17ab-bdb9-4329-8026-3d063b27ac84.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\87ed17ab-bdb9-4329-8026-3d063b27ac84.run\__sentry-breadcrumb2 --initial-client-data=0x484,0x488,0x48c,0x454,0x490,0x741e5160,0x741e5174,0x741e5184
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Program Files (x86)\GearUP\9271\WebView2Loader.dll
Size 113KB
SHA256 4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c
MD5 999f67ef1a2d06beeaf85ec9b5d5d73d
SHA1 644b1768f8675b29fb53a51edb5d344fdf55946c
SHA512 6399fda1c54bd26ce82b7d48ac1b7c9741d5abf68a67bd62ec53ea2a1f82caac2e9bfdb1cb22f5af3c8ca6f4789a888f6519e02941f6c33f6f9d3b0e58eb56f4
SSDEEP 3072:OnbFYqJx7sXRq2KVs9iiamgqeNZPTj7EtJlAlHJcgf4fm9pS:OZYqJx4gkYiavEtJe9f2mbS
TLSH
T130B36B5176D08072E9BE0A380874DB655B3F7960DFA09DEB67845AA94F317C0CE34E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.dll

Path C:\Program Files (x86)\GearUP\9271\browser.dll
Size 38KB
SHA256 9c25f4fa25116542a9c16d94ababec450c6184c6e8bc3cd90f3d9dc4ed5bcc39
MD5 1360c1d67a865ba1f6085e2246f42677
SHA1 ea3eca123552859a8ef4bd0c2db133acda97c300
SHA512 64c290db722c28cd613cf0674d0fccbc54b1b9c5338b59cecaa2cea1d78ec061793b12eb2289d9b901f84b91fac85b9a6f974e3ca751ac31f788d859a7bdae07
SSDEEP 768:W2S9NVky9us6E7y9AHCvQm0OfqodafH6VV4abtkYiQr4:V8NV5eE7ygOf8S4Gk7v
TLSH
T12F0370074908C8B6DE48193B39A455175E9CE7B627A08CE3E792C0987FE3ED63D761C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.data

Path C:\Program Files (x86)\GearUP\9271\cache.data
Size 650KB
SHA256 012f606052d67aead6899f8c7de7e8be4c17ea0cb82430f87e3881b7d76df559
MD5 b45a8fecafa62fb1a5b54f094dd29061
SHA1 a3775663415ef5ed2ad5017d5f5d3497690c86e7
SHA512 d5184ea6c407921bc31199ed0a3c0706c352350d99babcd13a46994d57659e4e8815086df00aa99ed65315fd25f4498fdfb764c5995f1dae8cd37e7bcfa38845
SSDEEP 12288:YiAhxg2MoLTZyi4vpGLtBcBQhvPT0w1vjQm4BvOy2x25ENbLiiNMCl4JFDCI4rU4:YiAhxg2RLTZV4MthVPT0wBjHy2xiaLiK
TLSH
T14AE423E9C12AA362671A65C8F378B0198C5F472B49D9DF78D1DFD3CA1173480EDE8622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe
Size 853KB
SHA256 80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150
MD5 5a243339440082631749f4bdff283bf5
SHA1 4c3512320b1b3c05ce265037a37aa3f16d3cc57c
SHA512 c0b889a819ac5cc6904caeb37e504e6a50d33e49a0e6fb6bdaf8e372190c9bca021017103a7dfcedf7e2c8d9c6a1f3eef103cdf389a5f6bb9ff71f03783ebe24
SSDEEP 24576:CLblY9+TeiDrZAdMgz3QZ5qY0xTHeMjoOvQdp89T7a0DPafB:0l7xKWnqY0xTHeMjoOvQdpCT7a0C
TLSH
T1F0057D307E1AC135EE5201F389AC6BEB81AD951A8B7706C361C8576D6A742E33F33917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_wer.dll

Path C:\Program Files (x86)\GearUP\9271\crashpad_wer.dll
Size 36KB
SHA256 e4a2295cff0949d9f0a646f36d7fbaa40fefdbf5958d21b091f95d9c96c345d5
MD5 e161e5dd4c57dbb72ef46cd60ac7c8b3
SHA1 7889c0cd22720bb76195bb8de0b77ebcc8068d57
SHA512 d08200a5535cfafac52a0fc16b5512863d6d8d70514bd8cd3324451c47cb5cd5d5592c3ac1440308f52d4142c1551a891a1d4ea7332159b2f4c5bd249b6fd100
SSDEEP 384:U2DgZd8t/u9aQZjkfXUEHQIYi7caPxh8E9VF0NyUzDUf:U2DXt/uLKsu5Yi7BPxWEiEf
TLSH
T1D1F27DA68D242D23DFDF4A74B0E449764E7466005FA180D3732EC2994F993C3BBB916E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcount_wapper.dll

Path C:\Program Files (x86)\GearUP\9271\fcount_wapper.dll
Size 675KB
SHA256 1769c0dae8f211b33784be128c778d8753f71dea28874d0a3034622f4ce00f80
MD5 c59ee7906a64069f8b63dbf86b9bddfa
SHA1 2b7fb8ee33125eaf36405f87501e54bbee90ffef
SHA512 b1b4b7759256689faf52832330b56c331824d131fa847feba501320f0c6ec3a89a4ebec8f9401f5596abb4be7a4cc419bfd799c8bb031a043af13359ad5fa999
SSDEEP 12288:AcjH+4SKRvLcAG6UXoakH8cmC0yNDZTgEHx:Acj+4zJogUXlEX0yNDZ1R
TLSH
T1EAE46D209640E136F8BF0076DC7D869E605C6B31076444DFB7C8AE5AAEB66C1BB31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_ball.exe

Path C:\Program Files (x86)\GearUP\9271\gearup_ball.exe
Size 2.0MB
SHA256 28d00a038136f7e79e4993c1220edd97b31e86a878a442a0caa1e06463947092
MD5 1048006498f8f5d79c0922a634e19014
SHA1 5a90dc4c1b2f2607cf3f6b0db393fae41a461d2f
SHA512 0014788c2758aefc6956adc8cc9b19c15beb285a49157f88f98f6fc83714c27f71805a3b2c88c7ecb178dde66d5447cbb7ef5a6c2db7f43b5779001bbf17c97b
SSDEEP 49152:Y+5+kHNyu9SA8qVpRJdLHC3pkexMjtIfpXW4:75+WNuA8qdJlHveyu
TLSH
T136A58C02AF834476E55F0A759EBE573ECA34AE10033495C3D79F3C6568712E26D3A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.exe

Path C:\Program Files (x86)\GearUP\9271\gearup_booster.exe
Size 10.1MB
SHA256 51df426089c7999813f78979b861fb0678b2637cfd208adfab4b4b0901e72df6
MD5 8d38868b3a6ccf21732976224ece4f44
SHA1 fae2bd695bcf8e498010cd95c2be0eb7cd82ba44
SHA512 daed60ff251dea0c05a1f8299cc780e4c0200442bff877cbb38888359ed9c4fab73f56e29325c8bfe11303d875996be6f61f47785c349909e0ce9d99d89bc899
SSDEEP 98304:QP+Hb1qVv/iZk5jqmPxtrAT2FY8baUJ9kZDMFmCaYCPCu8ssSjgjY5f0yuyNqdg1:2+HMV3Hx+b8uUPDduUgnkvU
TLSH
T116B64B14BAB28129F9F715BBDEBC591D843D7DA1072C80C7928838AD64A2DD67D30F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files (x86)\GearUP\9271\libcurl.dll
Size 5.5MB
SHA256 028dfda38f9aa9bbed5ca3ef6a67cd66ea5e44d68b7781d9717b35b138115fe8
MD5 745b206e518eea5b73bfed7631ccbc9d
SHA1 4422c68c5939833a5fd6169f7c05fed2bfec6f7f
SHA512 8406cef16c550e995fd1e744f59a8fa2c557e9eccd4de6e6ccbecc317fbab46f601f0280ef2b53daf6e3b37b320888443738b3336467146157e527501b07f02a
SSDEEP 98304:0cGYaW1dJbQbLC9b00oA9/4uAxCarTSbcV5:0+aiZoGTH/+xvmQV5
TLSH
T15B46AD17FF8266A0E9CE427E12FF6B7F4D3A5A18972494D38A5128E8C8716D1733E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lunasvg.dll

Path C:\Program Files (x86)\GearUP\9271\lunasvg.dll
Size 484KB
SHA256 6a6991d8d36530b566c98324db4fce30fdf834f9db6291bc1f27443d4d280c56
MD5 5b4fd4e5171e635a0adbaf46396c54e2
SHA1 d2d10ffe8a85f28b35071a327a053543ce26a230
SHA512 dac6a5ffba6c0ec46086309bd4feb7b8f90d22c25e8081fc6089d78f89b2fed98d8f50aa586ab6e4a23eee11c05fe4ef57215ca92a80b913467f1aebd56df500
SSDEEP 12288:E6JcA+NdGkkSEvhf2g1LKYH5HMHt/yGdC:E6JcA+pkSahf2KLKYZHCtd
TLSH
T17DB4AE32B822C271F9D912F1F9BD6FAF55396E2007AD4AC367C848A5C5609D367B3243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Program Files (x86)\GearUP\9271\msvcp100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\GearUP\9271\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\GearUP\9271\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngpush.dll

Path C:\Program Files (x86)\GearUP\9271\ngpush.dll
Size 6.7MB
SHA256 bd3a87dbb6199c0a8b486e779454743b7cfa845e96069ceeca002d4d1f0cdc27
MD5 3f8752a0eaf92532dbde97e93ff6f762
SHA1 3e0ab23e1b0daa7b0be9e9d3a382caf1b41c0f47
SHA512 a9c1bde7835c76c4cc719082f469881a31d81e12c7d11e8900e7bfd45eab46f1053fa7907cb7ac1a209fc1c321711e2bcd411d2836288dade6bd383781709150
SSDEEP 98304:yvky8kf7yeV4fZiu+nETmnZeGA14uu+Pb4G0hqB6SJ1yh6:Wkcf7PeTjSvSz
TLSH
T1B066B022BB568161EACF41BA55BE6BBF4A3C4A144B3540D3D6C42D6ECD305C23B3E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ping.dll

Path C:\Program Files (x86)\GearUP\9271\ping.dll
Size 1.5MB
SHA256 3acf492ce8fd2eff24d4f45bbe907bf5cece8b476e779c4456cfa416b8d1f172
MD5 cf60804cc5cb6d4cd777567680f19d32
SHA1 90fa4acf2c0aa5d564a5cb185b3b98d2e32c7bcd
SHA512 fc115a13c2ad1c6347f4edea140fd99e5174a7bc49683875bf0f2fb6d122d42704917740ab515bf16bf34f7fa572824a3599f124a4bd567469dbb258da8652f6
SSDEEP 49152:2El7DpPb/gX+0Wrvl78lPpkVQUX0wCwe8:Hl7NgX58gluVQW5
TLSH
T12675CF03FB8644B1E94E0B3963B7A77FAE359A008324CAD3DB603C5598716D1A63E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Program Files (x86)\GearUP\9271\sentry.dll
Size 426KB
SHA256 4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05
MD5 bf9002bf5c878cdca749025a5f875d6b
SHA1 e916d3121706dbd1ada335b414e4601373b86ef8
SHA512 34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20
SSDEEP 6144:p7HglxMmuzFL2PHajb28r4A/Y7+E/P1cVYr9BeVWiOYaGXQB+r7eY:p7HAx3IFL22707+oKVejeVWiOYaGXQK
TLSH
T13B946B313E15C275FEDA01F6E8FE4FEA896C5965473A01C36AC826957A700D73B3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.dll

Path C:\Program Files (x86)\GearUP\9271\skin.dll
Size 13.6MB
SHA256 cc3f568f7b2f402325713e2a6e2834eb280340f09e736536b40b43d2a64faea3
MD5 e35b9a4463b55b974ac359b9a6e37b6e
SHA1 e657f12af1fb57cfec438b6d233f792e2c8a1779
SHA512 fb2794f6683825d59da677a587208481bc6b59e7fc8453024529ac2525bf37ef7373181cda0baab90a6c7a15bdd6969edc00866c77402b9ee6fdbd1e06d8a84e
SSDEEP 393216:ea9wpJFMxBh348rsR8WypH2wLJnK8Jd6NgNfS:eax34w5nK8fmy6
TLSH
T1D4E612E3F327A994C62B5F352CF75690B437F67E8F21310B6420E6A16DE3AC14A86345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.dll

Path C:\Program Files (x86)\GearUP\9271\ui.dll
Size 1.2MB
SHA256 48dd89d0ee10973965649acc22fb7a2fa9cc0f98534608251fc19e08d9358029
MD5 37a160bbbedb5785c380f831aa49289b
SHA1 bc7feda05e63ba3c14f3913dce6fcc29add41e16
SHA512 e616aa3704cc55e5ec83b18d155cfa00c58a8eec0658af7a9a4aaec32706597e4686f9becfae0e5b1a1a4e5ba990ae88409b6e1d10ef55805d0459e1db903073
SSDEEP 24576:HsiG9UBQQUNYdBE9AqFZjb8t1RVrYyJ4G/:XG9UBQQUWBE9Ar3YyiG/
TLSH
T1115549702E9581BEEF92D177CE3C7B6D24AD92421F2442C371DD0E1D6D624E39A326A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui_webview2.dll

Path C:\Program Files (x86)\GearUP\9271\ui_webview2.dll
Size 238KB
SHA256 dd983e65318b3290574daf8309c53a5706c9f744f4efbcc2fdb44af43cc5cce4
MD5 0cd8b64f29171ccb509565c5e8c7c2ee
SHA1 12045ac3f825724e1d0abb7930ab1cc7eb7105af
SHA512 4c1baf3ede71658435d8c8cce7a2ea881cd8ce628ac87be28c10f2c82b7d463095da0ccb32c840f718bcc566ce7af14ffb2e7976917e9fcaf7e3f451837da2be
SSDEEP 6144:lT6J+APD6jfiBtqpdAbMQb/wbvb0bxb9bMQbzlbZsZuTCnvsdjWdwu5huAdWuBAX:lT6J+o6jqBtq8bMQb/wbvb0bxb9bMQbf
TLSH
T1D0346C317145C639E7DE02B54C6AEBDA12ADB6361FA1C1C7BBC4DE1E0D222D12B31627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files (x86)\GearUP\9271\uninstall.exe
Size 2.9MB
SHA256 35e8b88883fbd447f422930e62e4d4ff46ae3e5a72b41c21496f65666395ca0e
MD5 6772b91aaa595a74ad295edc58b3ecbf
SHA1 f360169239ad04cdf187ad919be4de0108d116d9
SHA512 ef53b768e884a5b290f681ac507f9c83ef33450f510e27b6c027b7ce83056014d8d02f8a814fe1edc6b55aef1a1568a8eb8825f45cea8f8cc8d3cfa2a1de9d3b
SSDEEP 49152:VSYcuw0CYD7Jr9eViMWVZcUjovDP/n8wJUbJMGtmARpk/pFMbRd94LnCxgv2:VSXYJr9eHQaJUbJM3AE/HMV
TLSH
T1A1E5D012FB868072E567073555BAA77B9935AE200334C5C3F7A53D2C58706D2AA3F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Program Files (x86)\GearUP\9271\update.exe
Size 3.3MB
SHA256 71769894cfefc9d38776ea758f82f392615d1319f2678808b0b88dbbe2859847
MD5 d04808eb51076e23a48ae0fa7bd93d44
SHA1 3ef2358532ca497ffa154f5200717cc8f63b98c4
SHA512 bf6901b14026531831c454cb2a091ea3522acca945367caebcdb607f65463bd954cef6b6d309d5edde34f83e6655f93ff8b296b3d2b01bfa9ab07b9462fac66b
SSDEEP 49152:wxzWxg94peo1jbbr/5uxCRyT863YeYxLMPCUIViccUpkCs1CRT+zCcQQKku4FA3t:w09F7yA63YPLICUYiccbNo+emKp4FW
TLSH
T1C7F5C012AE878072D55F06745DBE97BBC939AE21133485C3E7AF3C6C18705D2AD3A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\GearUP\9271\vcruntime140.dll
Size 88KB
SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
MD5 81b11024a8ed0c9adfd5fbf6916b133c
SHA1 c87f446d9655ba2f6fddd33014c75dc783941c33
SHA512 e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1
SSDEEP 1536:ckch/beb1bBhdXPFSAS7wIVktX8/eZT2G//ecb2Z0X3I+zl3z:ck2+1blXPg7wIVkts/UF/ecb2a5F
TLSH
T14E937C02B5D48071D9BE18B643A9D6027A7DB3A14FD60AEB5FA59CC89FB57C0E730207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\GearUP\9271\zlib1.dll
Size 77KB
SHA256 b9cbdf114c7c403d844550c12d7dd8c755cd58b5b4f99135d812bafd444364ac
MD5 e3523734f05af14a7b74bc026e3d31b1
SHA1 bc54a7b2adde2004903840ed8279e8b975c67fc2
SHA512 1c81bf56978e86299fa21573e6a6cfe942b7289ecb8e7ee4b1a67af3639d1b45d4274f00f35a0cff4d0e75da420e9fce4183ef439ff9cc62914f3df563a27104
SSDEEP 1536:z77FCOWzicqQPFwYZEABJx98se//002UldXfyIOsIOpcKjKr:TFlWWQuaEsJ0JbXfQipcKj
TLSH
T113739D41AB9143F5D4F5017681F7472DD63630208B87ECEBE28DB6E988127D1AB362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
Size 589KB
SHA256 0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035
MD5 c6d72642721e84d227defc3ec4ab12e6
SHA1 3709a7c3cc795a0012adc6ccaf82a93628703518
SHA512 fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389
SSDEEP 12288:qwW5Af1q9Wq0/rxaxQhlS/a4zdFGDyV+LrnYkdcmE1GN6:qwWO+BElQa4xFGe2rnYkdcb1
TLSH
T1FBD48E133AF5C0BED6620530CA1E6BF5A0FA97680B2248C767D08E1D1B798D5C636E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.zip

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip
Size 28.9MB
SHA256 f490312b4a25ffbeecf991144180cb53ed7385e783a2e924ef29f52e36a1921c
MD5 976f177c6c2aa055949e85580ab0d3ab
SHA1 9b60e6c0ce58aff080c383da961bc1e1e4edc517
SHA512 e193904fbf910665be4b922697c61d514b8ce82c602fca38f36a00ae37014f2d26d9b5d53a3321d1bf911a196a8d579ce3a30a2559e6afde6d228d83de4c6a24
SSDEEP 786432:Xky94UL7kslO8Tte3JpJvecc5iZnRS7zUJu9yIv6WKM:YULY7OgZfpVQ7zUJu9Rv6WKM
TLSH
T1386733D98363A895092E6803D2B91F88539EE997DBC7EA13351F4099EC074C391DED8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files (x86)\GearUP\launcher.exe
Size 1.7MB
SHA256 ec25bf5c9461a94bd3dd665798c45ebc2f86a0e04051b86ce9bb2c4dbf64f397
MD5 38b0fc95bf3f5ff938d204785f85442c
SHA1 c4977d2d78cddf80599c30cdb6583bf34695af37
SHA512 2b6909849a7725fea39eebe65c34995839c08b82dda5c81da11ae7843a68ca67c0bb6b3082f40712eebb2fac92353b68b170eae7d3ad1af3fcc25f5787a6cceb
SSDEEP 49152:24JmPG4iH+/3/s9JB0dYhVYTpk5WjsSdHZ9:26+/3+v0d2Yykjb
TLSH
T1CD85AF02BE8784B2D84E0A399DBF977FCA35AA114335C6C39B5F3C5458212D25E3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GearUP.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP.lnk
Size 1KB
SHA256 c18dcdab961809335aacdd032cbadcb699669ccb58a99360e2844f999781ab30
MD5 5915f909cf39dac27b99e8f3ca64e6f8
SHA1 09e7fc21ed18306d51793b561501909ec8f78f20
SHA512 11e7ca60f4694245c7a8a297e00c504ab74eacb47052f4aca7f41755a8daeedd2e4e4a064b8513d9fd0f5a5ebe95a2d64cf7d46547a77a29195267e158ece0c4
TLSH
T1F941C2080FDA1719F7339679A8B746626537B802F3640B2D41C1C74505F652A69ACFBE
MD5 SHA1 SHA512 TLSH

Submit Download

gu.log

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
Size 1KB
SHA256 403e4dbc6d62a654ea5a5c51ab49145cc19dc088d148d39bb8d18235853a9cd6
MD5 25796b2df5936b50db16c2b7f503ca4a
SHA1 f72c02e41af2afd2ff8a7c2fa2443883cffa8ad7
SHA512 f69b8244786f9131a2548483a69e08b401bc9e09fd2579ca37511b4fa9644908a166550872a56cf83a68d1c451fd01a2d2862fcca1af6df4b1a9d1af9b3ca472
TLSH
T1183174F945281F9276BFD93BFA389B34C9609E348307794340D787A183EEB617A13429
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 728844985b6f1b4f6054c7733e91b19db746b45492342f744832e0f565eb1b50
MD5 02afbba7b2817ec91eb8f677ff0f0244
SHA1 294e5dd723dbfda5470ed8802787b210e8129aa1
SHA512 d4546d6fd369b1b57e9bc82e128631d789647c512050616ee1d752bbbe61274d9d2fc629033e0e6996c28efb264997be872bde8dae2ee4cf0a5aa58e6007377a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fd3627972921605afb4ed896eecd6ca0632c69bebd3a869ffc6500aeca5613cf
MD5 f7583ee66b9bae1192c406bb8207622a
SHA1 a2f53aa163cce9af02024c342cccc5f2a94913b4
SHA512 ff90277682bbfe75abab9863faf3faa11fea9f1fc8475ea3bdbf9dab568adfe7e3b311fb558e86b90c10cd14a9a01d00e56ab421e2ccf3bbafb38948f5b219f9
TLSH
T1B9D0122A3A2181B9C21425330013A3080400D10B810D8004582DA52D5E040600E06896
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1d6e89a826149a3038976c5b152680246dc6eb95e96413be48035f6cb5de82a1
MD5 e46b6b4397aa63f5a6dd3a18e1bbdc61
SHA1 e3c11a4e77d7b13bac0f24515da4e82af335fe02
SHA512 7641a3dc2ffd17552be2b1e653de176edc1f152b039c51a8802fbe477a0d5105842598f6f68b7f33efcbf3e9d75316e179d2f31fd9344271f25b897800690b22
TLSH
T104D02B7A363545B6C31872334082E3481000C11F410E80041E3AF92C4E400F20D85C86
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Cache\Cache_Data\f_000001
Size 16KB
SHA256 d16f10a78832d2b22c1648696be25b815eb91660a5dc3f0a727d3df89d9b92de
MD5 6198e664b13465a674ba2f592040723f
SHA1 683610349d24603ffe3586e752e18426ec793e8e
SHA512 e58ffba59e237e43d39e742113a7aed0f6bbeb2e1f97caf77462703516664669aee7b6b7cec533ca4a9fa3f1071fb796d9fd29a34040be8939b7cc8f1862ac5e
SSDEEP 384:yGGnUCOxN7jEJgUnrXDv9TnRLAvccScX/AV6AeRvsZesMOI:I6xREZnrBTNncScvvGMOI
TLSH
T1D472D1D2FA9C8854838F60C57C3D883505E2C1922A6EF39ABC33C3E558D97B769950DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Cache\Cache_Data\f_000002
Size 60KB
SHA256 8e2bb606700e80cc27063f2fde1ebdad11430ee938358709cc4dac54ccbc030c
MD5 5203c71061fd72d37f954b6531c7f699
SHA1 fe34c488157a83f0cb75c56aad0da57883024384
SHA512 4959a8798de2b5b58eb84e2d251e8467892b9e149d7ba17dbe31de46e50cea62ddc7055020f1a062e6f51ebabaaa203b45ebcd1f09c572e10e52c0ff0e9aa4b1
SSDEEP 1536:6MQGVRBzKXn9TbrHzmQT9EM46T+drQMu8e4lt:nQ+Rs3Brzz9Ed7hLur4lt
TLSH
T1165301F421BD3F4F20755821129068882F76AC39679DE1563D60EE2138A057BEB72BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 9f7d3e56d6643a729d982679912ba9e144f8045ec2cb05c9d1c64a6d1dccd8d2
MD5 e61c8339a9dd55d5750a5503195ae62c
SHA1 cfa84565ce112067f9ade68627f858d59f42776c
SHA512 862870efea7d42520347583f9c8aa167cd564c247d3316720c57901ac12b9669f2d46eee838fbb4de9b4c886e24b8d9b46056f8014c2cafef1298de652f62a09
TLSH
T1FDC0C062413DE032207C07221CD4BD82DF36F135114060FC925F02BCF04017A7383413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 3f9b84ccccfdcc5904e354b8d903eb0592762b8c93a369217aa4c42a2e51e5da
MD5 4bc97d7e47035d650dc4c9f14092f697
SHA1 f51c23aacc6578e5a9a9890de19bd08249b7b236
SHA512 6eb0a48abb379c37948dd59df639f66a6c95096a16580a9fde917f112637b0a870fdedc01b42529507e23467389147afc203e81a5a16b3cbf836bc6b5ec483cc
TLSH
T192C022A2402DE03220A8463269C4AD985E36A5351240A0EC82D2073C60401AE6243423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
Size 6KB
SHA256 899ac0b11fbdf6d26b563164880fd7f11d54e265bdaa2872a24359880f74f9cf
MD5 0b14d457c2991e036104ba5066dc63ff
SHA1 965c2b93b6867a3a585c1c2de37edc4a71106c8b
SHA512 9fc3495cc5aa44008763c586a26ee0a913d5ef845e7cae61428e4fe9bb7d8e0ce7b73ceedb0a44b0f6571bf35c6be928723063713c50a2cba3d5065683cf009a
SSDEEP 192:stvt0gYm/HojfV+Z8paggvx/S+Wi8v2jJQdtdFU6Zd+LMC:stOgSjvU/VTQjNC
TLSH
T13EE1C8525EA879778CCBF2097A35BB53E2F5502265C50E58EFFC861C04D66CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
Size 6KB
SHA256 f18c4c044b98f18658e3a4b12d3af84ad2305480bc1d15f5f073397e9dd9f45f
MD5 4a5dd2aa4369d329bd602022df6ac003
SHA1 5d2d56205594f8681aae00ab651b113f45775f7e
SHA512 03df7cd843d7d7d431e3d640e35e500697835f35c1a2ae69fb7ac0275e756e3ef52a401fc476732af6588e359091a3b6d535832922d157c0c31f6df07b9d1ac2
SSDEEP 192:stvt0CYm/HojfV+Z8paggvi/S+Wi8vIjCqdtdFZ6Zd+LMC:stOCSjv7/VyquNC
TLSH
T1A9E1C8525E68A97B8CCBF51A7A35BB52E2F5102265C50E48EFFC861C04D66CD1307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e42c.TMP

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences~RFe59e42c.TMP
Size 5KB
SHA256 b37d493751395014280f9c50358bd0203112a0b56fdb3cbf5ac30baa8e08cf74
MD5 e06415dbef8cd4da7edf69e3431465e0
SHA1 35a8114dcd0d4581a641b6286b13139112e7027f
SHA512 5c3cfd5f958681a2b35ca23648970fdd06559ecfcd31c3c69de574fa3431003650c6f552dcc6d95fcad0b70fa57da660b1b09030b3aebbf53bdaadff7b687ecb
SSDEEP 96:stvt05kYW/Xib9UjfftgdZ8i0oEgdklm/7qx+WVHMSm+uecadQjWd+gB6Zd+MEB:stvt0CYmvjfVGZ8pFgb/S+Wi8dtdX6Zy
TLSH
T1EFC1B7425F68A97B8CCBE20D7A35BB43E2FA502265D50E58EBF9861C08D66CD5307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 16KB
SHA256 578c77f102a26127049f143c2f07a73f32ac37dfb7f074714e6a9e24d6b50240
MD5 85d48922fdbbbb1f4cdecbc7bbfd6984
SHA1 f93f64bf060b638ec24a22dd19077cade2e2187a
SHA512 152c77fb552f600723757d09853b2b9cb74397f497c3f5e01c0596c0670cd5fcc7c7a567a20da743d91c175ff73e7704bdb1ffca50cfc63006d6173733928e2f
SSDEEP 384:zc+aQikB+z/xvxjg/qhELNbJUi/GJVm9zG:H/UxvxjgC+0mGJcFG
TLSH
T1F3729E7B64A97E2798F7F9067A49178BDBB8446294825EB84EFE5F0D02C73D81302D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 1KB
SHA256 ac736a2315956dfeefecc460229af24b769f2307b93369814a6169a1584cf574
MD5 82f9f2997ae8731426d4958c41eb8431
SHA1 be8c0891a6e59992f983a71a7a1e8a80e90c731f
SHA512 0314c4c122908b90341bb8e2567bb6c25c9e9992890501c07d5342d433ebdda02a179c630822e5959b1d87f474523077c7459c14d9da589d19c08a1980f9dabd
TLSH
T1E43185F3E4D47B369C97558271413687BE712025C0064F88A6EF4B0C02E72DD6A2AD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 2KB
SHA256 97bf10c77fd7061a5e51d8eb0d6c441507e4764ad8941b4b88cbcd3e9acac698
MD5 333e2f57df0c7745682f6173eac777b0
SHA1 5210720773c5788feb86774a0c8be75ca8e55f85
SHA512 50ce60facdbfdcaff578061fe334eb98768ef48598d2601719ec0ef99302eef11ed0f329d24488e79887ca86ae59d6797fec590581e44136d6366a769c038a02
TLSH
T1C451C5B3B848BA37C8E3494579453B53FE755021C9562F949AEE0B0C01DB29C3702C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 3KB
SHA256 88e19f8af8a70c147413d4016253adb2c806cddb041e96b052174dc18a8710ba
MD5 1bbbb41be1bc85d941fda00af5c50ef8
SHA1 62d75597ff3cc90b7ecde0703843f18eafc5fc13
SHA512 b6eaa67e4fe919ffa6a43453cd748c2e967a7d12862e96bee8796c434eb2668af071a32aebe6e1877343988337dcfc88f90e312671911f59b02d3b89a7c5f91b
TLSH
T18271A6B7A8A4E9378DE39945B8853B07BBA55136D5863F98DAED0F0C01D73982302D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 16KB
SHA256 f59de1c5cb620cc0528fdfd1f3c5b9631af7328653a0da01eadfb8bfc69c2f2c
MD5 a0efc877978321b0678fce6bb66a3e0a
SHA1 c19899ef357bb5b235ca362f63d9f50c8b26bbea
SHA512 2d553f77b5d133420fc45ef2a763873e3caa9ed8b4034ac9c2433e236956811569f55347a967d45141afb026a0b79d2aa9f71e3fc924238c9a6b0b386f8cb18f
SSDEEP 384:zN+aQikB+z/xvxjg/qhEwNbLli/GJVm9zG:0/UxvxjgC+imGJcFG
TLSH
T144729E7B64A97E2798F7F9057A89179BDBB8446294821AB84EFE5F0D02C73D41302D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 4KB
SHA256 f086806cd301a6e1a723d4346b890ad013b4a3df8e1e818b03987299d5329575
MD5 1871cba2cbc88e09b996244450a3e45c
SHA1 6689995592806582cb96625b2f71b61aa9280b95
SHA512 4907e3f0e0edbc8ffd063ed3a653e44a4da31ed03463e89703b823d220de8b7b996a95a2b94109ecc0a2dee65c3fa0bed0ebbf40c60003891cbcc47cb9ca6758
SSDEEP 96:zuXYbNkCEcfUREvjX58Frh/cInURoDotoivs3tDvrVEBx9h3dP6tmZ3b+MQTaml1:zuYbNbCRWjaooDUDvYvZox9h3Rhoa0
TLSH
T16D81A477A9A4A9378CE79946B9863B43BBA15026D8853FD8DAED0F0C01D73D92302C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594452.TMP

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State~RFe594452.TMP
Size 1KB
SHA256 57ea896400163474340c42bf0f5944a0e24cd5fd18e3ebe064a807104b79c55d
MD5 4bd131040388afb6ce158b09b62906bd
SHA1 9a48d8d93f4c618fbb427e5cedcdff989040a1dd
SHA512 eb475783b7ee5789f07ce6759fd531a6282dbd631c55b45d9f43caffbb397f98b1f4a506264a54dfd097006164f61e35c5193a3a5ba00dc69ca89423daca020e
TLSH
T1702165B3D4987A36A8960592720176873EA06035C1054F48A6DF060C02D75AD6B26D33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3680-551-0x000001488F670000-0x000001488F6A0000-memory.dmp

Download

memory/3680-452-0x00007FFB96210000-0x00007FFB96211000-memory.dmp

Download

memory/3680-451-0x00007FFB97CF0000-0x00007FFB97CF1000-memory.dmp

Download

memory/3688-0-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/4572-381-0x00007FFB96210000-0x00007FFB96211000-memory.dmp

Download

memory/5280-481-0x00007FFB96210000-0x00007FFB96211000-memory.dmp

Download