cf4823a2153c3a6eefc800c7fdfea8ce342d07f2b064348385ec11492b9f859b

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
601s
max time network
568s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GearUP-3.3.0-ankol46.exe
Size 35.7MB
Sample260930-nrbfkatgrd
SHA256 cf4823a2153c3a6eefc800c7fdfea8ce342d07f2b064348385ec11492b9f859b
MD5 ea7b30ec36c0703f22f349f04ea39af2
SHA1 f39b96e4619ab1fbf4dba7560ad60d0a6ef19d08
SHA512 6ad223835cc2cf7ed56f8199afbef3d3748d30ab53a80384c0a4c721a0449d0276b46e29a156d14949298aaaa40b919db5c7291ff2aeb3cafbaee175dcc83c57
SSDEEP 786432:sr6GBEIeky94UL7kslO8Tte3JpJvecc5iZnRS7zUJu9yIv6WKQ:CEYULY7OgZfpVQ7zUJu9Rv6WKQ
TLSH
T1E1873302BF938072D56B05319A7D67B6D97ABE205331C5C3A79A3C2C5C316C2993B39E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\Y:\	gearup_booster.exe
\??\Z:\	gearup_booster.exe
\??\I:\	gearup_booster.exe
\??\S:\	gearup_booster.exe
\??\T:\	gearup_booster.exe
\??\W:\	gearup_booster.exe
\??\X:\	gearup_booster.exe
\??\A:\	gearup_booster.exe
\??\E:\	gearup_booster.exe
\??\F:\	gearup_booster.exe
\??\P:\	gearup_booster.exe
\??\U:\	gearup_booster.exe
\??\V:\	gearup_booster.exe
\??\D:\	gearup_booster.exe
\??\G:\	gearup_booster.exe
\??\H:\	gearup_booster.exe
\??\L:\	gearup_booster.exe
\??\M:\	gearup_booster.exe
\??\N:\	gearup_booster.exe
\??\O:\	gearup_booster.exe
\??\R:\	gearup_booster.exe
\??\B:\	gearup_booster.exe
\??\J:\	gearup_booster.exe
\??\K:\	gearup_booster.exe
\??\Q:\	gearup_booster.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win7\x64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\UniSDK\NGPush\uuxxgu_2_c834c170.json	gearup_ball.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-string-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\msvcp140.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-convert-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\lunasvg.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\quiche.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\cache.data	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\apiinstall_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\shence.log	gearup_booster.exe
File created	C:\Program Files (x86)\GearUP\9271\license\jsoncpp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-core-file-l2-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-math-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\host_fp.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\ngpush.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\ui.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\NW_TAP_0921.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license\lgpl-2.1.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\ucrtbase.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\arm64\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\lspinst_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\wfp\win\x32\gunetfilter.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win\x32\gunetfilter.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe	GearUP-3.3.0-ankol46.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license\lunasvg_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\openvpn_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\i386\NW_TAP_0921.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\gearup_booster.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\wfp\win\x64\gunetfilter.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\openssl_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\hostfp\64	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\license\jsoncpp_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\winpacp_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\lsp64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\lunasvg.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip	GearUP-3.3.0-ankol46.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win\x32	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wintun	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\launcher.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\uninstall.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\udp_connect_lsp_d.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\hostfp\32	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\kcp_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-utility-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\libcurl.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-heap-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tcp_proxy.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\wfp\win\x32\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\tap0901.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\cef_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\license\gpl-2.0.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\nw_tap_0921.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\api-ms-win-crt-locale-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\libcurl.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\ucrtbase.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\VisualElements	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\config.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9271\dui_webview2.tlb	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9271\tap_driver\x64\nw_tap_0909.cat	7za.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_144942403\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_144942403\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_139139223\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1368694554\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1368694554\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_414847702\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1158571108\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1158571108\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_898154550\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_139139223\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_898154550\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1008726304\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1158571108\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_898154550\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1008726304\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_688362595\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_144942403\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1907180450\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_144942403\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_945896224\Part-ZH	msedgewebview2.exe

Executes dropped EXE 6 IoCs

pid	Process
4464	7za.exe
5348	launcher.exe
1408	gearup_booster.exe
5756	crashpad_handler.exe
4448	gearup_ball.exe
4864	crashpad_handler.exe

Loads dropped DLL 32 IoCs

pid	Process
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
5756	crashpad_handler.exe
5756	crashpad_handler.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4448	gearup_ball.exe
4864	crashpad_handler.exe
4864	crashpad_handler.exe
4448	gearup_ball.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gearup_booster.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c57d-342.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1156	cmd.exe
2828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GearUP-3.3.0-ankol46.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GearUP-3.3.0-ankol46.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gearup_booster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gearup_ball.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gearup_booster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gearup_ball.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GearUP-3.3.0-ankol46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_booster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_ball.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	GearUP-3.3.0-ankol46.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUP\\9271\\gearup_booster.exe \"%1\""	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4676	WMIC.exe
4676	WMIC.exe
4676	WMIC.exe
4676	WMIC.exe
1408	gearup_booster.exe
1408	gearup_booster.exe
4316	msedgewebview2.exe
4316	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	4464	7za.exe
Token: 35	4464	7za.exe
Token: SeSecurityPrivilege	4464	7za.exe
Token: SeSecurityPrivilege	4464	7za.exe
Token: SeIncreaseQuotaPrivilege	4676	WMIC.exe
Token: SeSecurityPrivilege	4676	WMIC.exe
Token: SeTakeOwnershipPrivilege	4676	WMIC.exe
Token: SeLoadDriverPrivilege	4676	WMIC.exe
Token: SeSystemProfilePrivilege	4676	WMIC.exe
Token: SeSystemtimePrivilege	4676	WMIC.exe
Token: SeProfSingleProcessPrivilege	4676	WMIC.exe
Token: SeIncBasePriorityPrivilege	4676	WMIC.exe
Token: SeCreatePagefilePrivilege	4676	WMIC.exe
Token: SeBackupPrivilege	4676	WMIC.exe
Token: SeRestorePrivilege	4676	WMIC.exe
Token: SeShutdownPrivilege	4676	WMIC.exe
Token: SeDebugPrivilege	4676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4676	WMIC.exe
Token: SeRemoteShutdownPrivilege	4676	WMIC.exe
Token: SeUndockPrivilege	4676	WMIC.exe
Token: SeManageVolumePrivilege	4676	WMIC.exe
Token: 33	4676	WMIC.exe
Token: 34	4676	WMIC.exe
Token: 35	4676	WMIC.exe
Token: 36	4676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4676	WMIC.exe
Token: SeSecurityPrivilege	4676	WMIC.exe
Token: SeTakeOwnershipPrivilege	4676	WMIC.exe
Token: SeLoadDriverPrivilege	4676	WMIC.exe
Token: SeSystemProfilePrivilege	4676	WMIC.exe
Token: SeSystemtimePrivilege	4676	WMIC.exe
Token: SeProfSingleProcessPrivilege	4676	WMIC.exe
Token: SeIncBasePriorityPrivilege	4676	WMIC.exe
Token: SeCreatePagefilePrivilege	4676	WMIC.exe
Token: SeBackupPrivilege	4676	WMIC.exe
Token: SeRestorePrivilege	4676	WMIC.exe
Token: SeShutdownPrivilege	4676	WMIC.exe
Token: SeDebugPrivilege	4676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4676	WMIC.exe
Token: SeRemoteShutdownPrivilege	4676	WMIC.exe
Token: SeUndockPrivilege	4676	WMIC.exe
Token: SeManageVolumePrivilege	4676	WMIC.exe
Token: 33	4676	WMIC.exe
Token: 34	4676	WMIC.exe
Token: 35	4676	WMIC.exe
Token: 36	4676	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1408	gearup_booster.exe
4448	gearup_ball.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1408	gearup_booster.exe
4448	gearup_ball.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4464	1800	GearUP-3.3.0-ankol46.exe	89
PID 1800 wrote to memory of 1156	1800	GearUP-3.3.0-ankol46.exe	91
PID 1800 wrote to memory of 5348	1800	GearUP-3.3.0-ankol46.exe	93
PID 5348 wrote to memory of 1408	5348	launcher.exe	94
PID 1408 wrote to memory of 5756	1408	gearup_booster.exe	95
PID 1408 wrote to memory of 2828	1408	gearup_booster.exe	96
PID 2828 wrote to memory of 4676	2828	cmd.exe	98
PID 1408 wrote to memory of 4888	1408	gearup_booster.exe	101
PID 4888 wrote to memory of 1268	4888	msedgewebview2.exe	102
PID 1408 wrote to memory of 4448	1408	gearup_booster.exe	103
PID 4888 wrote to memory of 1052	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 1052	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 1052	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 1052	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 1428	4888	msedgewebview2.exe	105
PID 4888 wrote to memory of 5212	4888	msedgewebview2.exe	106
PID 4888 wrote to memory of 5212	4888	msedgewebview2.exe	106
PID 4888 wrote to memory of 5212	4888	msedgewebview2.exe	106
PID 4888 wrote to memory of 3164	4888	msedgewebview2.exe	107
PID 4888 wrote to memory of 3164	4888	msedgewebview2.exe	107
PID 4888 wrote to memory of 3164	4888	msedgewebview2.exe	107
PID 4888 wrote to memory of 3164	4888	msedgewebview2.exe	107
PID 4888 wrote to memory of 3164	4888	msedgewebview2.exe	107
PID 4888 wrote to memory of 3180	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 3180	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 3180	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 3180	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 3180	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 620	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 620	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 620	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 620	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 620	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 972	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 972	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 972	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 972	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 972	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 4200	4888	msedgewebview2.exe	111
PID 4888 wrote to memory of 4200	4888	msedgewebview2.exe	111
PID 4888 wrote to memory of 4200	4888	msedgewebview2.exe	111
PID 4888 wrote to memory of 4200	4888	msedgewebview2.exe	111
PID 4888 wrote to memory of 4200	4888	msedgewebview2.exe	111
PID 4448 wrote to memory of 4864	4448	gearup_ball.exe	112
PID 4888 wrote to memory of 1204	4888	msedgewebview2.exe	116
PID 4888 wrote to memory of 1204	4888	msedgewebview2.exe	116
PID 4888 wrote to memory of 1204	4888	msedgewebview2.exe	116
PID 4888 wrote to memory of 4304	4888	msedgewebview2.exe	117
PID 4888 wrote to memory of 4304	4888	msedgewebview2.exe	117
PID 4888 wrote to memory of 4304	4888	msedgewebview2.exe	117
PID 4888 wrote to memory of 4316	4888	msedgewebview2.exe	118
PID 4888 wrote to memory of 5000	4888	msedgewebview2.exe	119
PID 4888 wrote to memory of 5000	4888	msedgewebview2.exe	119
PID 4888 wrote to memory of 5000	4888	msedgewebview2.exe	119
PID 4888 wrote to memory of 52	4888	msedgewebview2.exe	120
PID 4888 wrote to memory of 52	4888	msedgewebview2.exe	120
PID 4888 wrote to memory of 52	4888	msedgewebview2.exe	120
PID 4888 wrote to memory of 5856	4888	msedgewebview2.exe	121
PID 4888 wrote to memory of 5856	4888	msedgewebview2.exe	121
PID 4888 wrote to memory of 5856	4888	msedgewebview2.exe	121
PID 4888 wrote to memory of 2872	4888	msedgewebview2.exe	122
PID 4888 wrote to memory of 2872	4888	msedgewebview2.exe	122
PID 4888 wrote to memory of 2872	4888	msedgewebview2.exe	122
PID 4888 wrote to memory of 1300	4888	msedgewebview2.exe	123

C:\Users\Admin\AppData\Local\Temp\GearUP-3.3.0-ankol46.exe
"C:\Users\Admin\AppData\Local\Temp\GearUP-3.3.0-ankol46.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
  "C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUP\" -aoa
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUP\gearup_booster_temp\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1156
- C:\Program Files (x86)\GearUP\launcher.exe
  "C:\Program Files (x86)\GearUP\launcher.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶换㑦改㘸敥㍤㌱挶㌴ㅤ戴攀Ӕ
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Program Files (x86)\GearUP\9271\gearup_booster.exe
    "C:\Program Files (x86)\GearUP\9271\gearup_booster.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶换㑦改㘸敥㍤㌱挶㌴ㅤ戴攀Ӕ
    3⤵
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe
      "C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lanplay.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\4686b216-b8d0-4b8a-37bf-6f04d8dabd07.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\4686b216-b8d0-4b8a-37bf-6f04d8dabd07.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\4686b216-b8d0-4b8a-37bf-6f04d8dabd07.run\__sentry-breadcrumb2 --initial-client-data=0x4cc,0x4d0,0x4d4,0x4a8,0x4d8,0x736e5160,0x736e5174,0x736e5184
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic csproduct get uuid
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --force-device-scale-factor=1 --lang=en --accept-lang=en --mojo-named-platform-channel-pipe=1408.6056.9953942245901114835 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe2d3e5fd8,0x7ffe2d3e5fe4,0x7ffe2d3e5ff0
        5⤵
        
        PID:1268
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:1052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1980 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3704 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:3180
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3856 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:620
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3872 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4108 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:4200
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4880 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:1204
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5060 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5416 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5416 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:52
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5432 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5004 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:2872
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4928 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:1300
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5408 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:3520
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4768 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=996 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:1740
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.3.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5512 --field-trial-handle=1736,i,1766488998731140510,6337956798453191081,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:2724
  - - C:\Program Files (x86)\GearUP\9271\gearup_ball.exe
      C:\Program Files (x86)\GearUP\9271\gearup_ball.exe /main_form_wnd 459018 /show_flag 0 /pos_x -1 /pos_y -1 /version 9271 /client_id 6abcf4a9ce26310d2034be19 /gray 0
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe
        
        "C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\19aade7e-ba36-468b-4c29-ef306caac9f7.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\19aade7e-ba36-468b-4c29-ef306caac9f7.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\19aade7e-ba36-468b-4c29-ef306caac9f7.run\__sentry-breadcrumb2 --initial-client-data=0x4a4,0x4a8,0x4ac,0x480,0x4b0,0x736e5160,0x736e5174,0x736e5184
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP100.dll

Path C:\Program Files (x86)\GearUP\9271\MSVCP100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NGPush.dll

Path C:\Program Files (x86)\GearUP\9271\NGPush.dll
Size 6.7MB
SHA256 bd3a87dbb6199c0a8b486e779454743b7cfa845e96069ceeca002d4d1f0cdc27
MD5 3f8752a0eaf92532dbde97e93ff6f762
SHA1 3e0ab23e1b0daa7b0be9e9d3a382caf1b41c0f47
SHA512 a9c1bde7835c76c4cc719082f469881a31d81e12c7d11e8900e7bfd45eab46f1053fa7907cb7ac1a209fc1c321711e2bcd411d2836288dade6bd383781709150
SSDEEP 98304:yvky8kf7yeV4fZiu+nETmnZeGA14uu+Pb4G0hqB6SJ1yh6:Wkcf7PeTjSvSz
TLSH
T1B066B022BB568161EACF41BA55BE6BBF4A3C4A144B3540D3D6C42D6ECD305C23B3E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\GearUP\9271\WebView2Loader.dll
Size 113KB
SHA256 4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c
MD5 999f67ef1a2d06beeaf85ec9b5d5d73d
SHA1 644b1768f8675b29fb53a51edb5d344fdf55946c
SHA512 6399fda1c54bd26ce82b7d48ac1b7c9741d5abf68a67bd62ec53ea2a1f82caac2e9bfdb1cb22f5af3c8ca6f4789a888f6519e02941f6c33f6f9d3b0e58eb56f4
SSDEEP 3072:OnbFYqJx7sXRq2KVs9iiamgqeNZPTj7EtJlAlHJcgf4fm9pS:OZYqJx4gkYiavEtJe9f2mbS
TLSH
T130B36B5176D08072E9BE0A380874DB655B3F7960DFA09DEB67845AA94F317C0CE34E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.dll

Path C:\Program Files (x86)\GearUP\9271\browser.dll
Size 38KB
SHA256 9c25f4fa25116542a9c16d94ababec450c6184c6e8bc3cd90f3d9dc4ed5bcc39
MD5 1360c1d67a865ba1f6085e2246f42677
SHA1 ea3eca123552859a8ef4bd0c2db133acda97c300
SHA512 64c290db722c28cd613cf0674d0fccbc54b1b9c5338b59cecaa2cea1d78ec061793b12eb2289d9b901f84b91fac85b9a6f974e3ca751ac31f788d859a7bdae07
SSDEEP 768:W2S9NVky9us6E7y9AHCvQm0OfqodafH6VV4abtkYiQr4:V8NV5eE7ygOf8S4Gk7v
TLSH
T12F0370074908C8B6DE48193B39A455175E9CE7B627A08CE3E792C0987FE3ED63D761C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.data

Path C:\Program Files (x86)\GearUP\9271\cache.data
Size 650KB
SHA256 012f606052d67aead6899f8c7de7e8be4c17ea0cb82430f87e3881b7d76df559
MD5 b45a8fecafa62fb1a5b54f094dd29061
SHA1 a3775663415ef5ed2ad5017d5f5d3497690c86e7
SHA512 d5184ea6c407921bc31199ed0a3c0706c352350d99babcd13a46994d57659e4e8815086df00aa99ed65315fd25f4498fdfb764c5995f1dae8cd37e7bcfa38845
SSDEEP 12288:YiAhxg2MoLTZyi4vpGLtBcBQhvPT0w1vjQm4BvOy2x25ENbLiiNMCl4JFDCI4rU4:YiAhxg2RLTZV4MthVPT0wBjHy2xiaLiK
TLSH
T14AE423E9C12AA362671A65C8F378B0198C5F472B49D9DF78D1DFD3CA1173480EDE8622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files (x86)\GearUP\9271\crashpad_handler.exe
Size 853KB
SHA256 80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150
MD5 5a243339440082631749f4bdff283bf5
SHA1 4c3512320b1b3c05ce265037a37aa3f16d3cc57c
SHA512 c0b889a819ac5cc6904caeb37e504e6a50d33e49a0e6fb6bdaf8e372190c9bca021017103a7dfcedf7e2c8d9c6a1f3eef103cdf389a5f6bb9ff71f03783ebe24
SSDEEP 24576:CLblY9+TeiDrZAdMgz3QZ5qY0xTHeMjoOvQdp89T7a0DPafB:0l7xKWnqY0xTHeMjoOvQdpCT7a0C
TLSH
T1F0057D307E1AC135EE5201F389AC6BEB81AD951A8B7706C361C8576D6A742E33F33917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcount_wapper.dll

Path C:\Program Files (x86)\GearUP\9271\fcount_wapper.dll
Size 675KB
SHA256 1769c0dae8f211b33784be128c778d8753f71dea28874d0a3034622f4ce00f80
MD5 c59ee7906a64069f8b63dbf86b9bddfa
SHA1 2b7fb8ee33125eaf36405f87501e54bbee90ffef
SHA512 b1b4b7759256689faf52832330b56c331824d131fa847feba501320f0c6ec3a89a4ebec8f9401f5596abb4be7a4cc419bfd799c8bb031a043af13359ad5fa999
SSDEEP 12288:AcjH+4SKRvLcAG6UXoakH8cmC0yNDZTgEHx:Acj+4zJogUXlEX0yNDZ1R
TLSH
T1EAE46D209640E136F8BF0076DC7D869E605C6B31076444DFB7C8AE5AAEB66C1BB31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_ball.exe

Path C:\Program Files (x86)\GearUP\9271\gearup_ball.exe
Size 2.0MB
SHA256 28d00a038136f7e79e4993c1220edd97b31e86a878a442a0caa1e06463947092
MD5 1048006498f8f5d79c0922a634e19014
SHA1 5a90dc4c1b2f2607cf3f6b0db393fae41a461d2f
SHA512 0014788c2758aefc6956adc8cc9b19c15beb285a49157f88f98f6fc83714c27f71805a3b2c88c7ecb178dde66d5447cbb7ef5a6c2db7f43b5779001bbf17c97b
SSDEEP 49152:Y+5+kHNyu9SA8qVpRJdLHC3pkexMjtIfpXW4:75+WNuA8qdJlHveyu
TLSH
T136A58C02AF834476E55F0A759EBE573ECA34AE10033495C3D79F3C6568712E26D3A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.exe

Path C:\Program Files (x86)\GearUP\9271\gearup_booster.exe
Size 10.1MB
SHA256 51df426089c7999813f78979b861fb0678b2637cfd208adfab4b4b0901e72df6
MD5 8d38868b3a6ccf21732976224ece4f44
SHA1 fae2bd695bcf8e498010cd95c2be0eb7cd82ba44
SHA512 daed60ff251dea0c05a1f8299cc780e4c0200442bff877cbb38888359ed9c4fab73f56e29325c8bfe11303d875996be6f61f47785c349909e0ce9d99d89bc899
SSDEEP 98304:QP+Hb1qVv/iZk5jqmPxtrAT2FY8baUJ9kZDMFmCaYCPCu8ssSjgjY5f0yuyNqdg1:2+HMV3Hx+b8uUPDduUgnkvU
TLSH
T116B64B14BAB28129F9F715BBDEBC591D843D7DA1072C80C7928838AD64A2DD67D30F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files (x86)\GearUP\9271\libcurl.dll
Size 5.5MB
SHA256 028dfda38f9aa9bbed5ca3ef6a67cd66ea5e44d68b7781d9717b35b138115fe8
MD5 745b206e518eea5b73bfed7631ccbc9d
SHA1 4422c68c5939833a5fd6169f7c05fed2bfec6f7f
SHA512 8406cef16c550e995fd1e744f59a8fa2c557e9eccd4de6e6ccbecc317fbab46f601f0280ef2b53daf6e3b37b320888443738b3336467146157e527501b07f02a
SSDEEP 98304:0cGYaW1dJbQbLC9b00oA9/4uAxCarTSbcV5:0+aiZoGTH/+xvmQV5
TLSH
T15B46AD17FF8266A0E9CE427E12FF6B7F4D3A5A18972494D38A5128E8C8716D1733E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lunasvg.dll

Path C:\Program Files (x86)\GearUP\9271\lunasvg.dll
Size 484KB
SHA256 6a6991d8d36530b566c98324db4fce30fdf834f9db6291bc1f27443d4d280c56
MD5 5b4fd4e5171e635a0adbaf46396c54e2
SHA1 d2d10ffe8a85f28b35071a327a053543ce26a230
SHA512 dac6a5ffba6c0ec46086309bd4feb7b8f90d22c25e8081fc6089d78f89b2fed98d8f50aa586ab6e4a23eee11c05fe4ef57215ca92a80b913467f1aebd56df500
SSDEEP 12288:E6JcA+NdGkkSEvhf2g1LKYH5HMHt/yGdC:E6JcA+pkSahf2KLKYZHCtd
TLSH
T17DB4AE32B822C271F9D912F1F9BD6FAF55396E2007AD4AC367C848A5C5609D367B3243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\GearUP\9271\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\GearUP\9271\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ping.dll

Path C:\Program Files (x86)\GearUP\9271\ping.dll
Size 1.5MB
SHA256 3acf492ce8fd2eff24d4f45bbe907bf5cece8b476e779c4456cfa416b8d1f172
MD5 cf60804cc5cb6d4cd777567680f19d32
SHA1 90fa4acf2c0aa5d564a5cb185b3b98d2e32c7bcd
SHA512 fc115a13c2ad1c6347f4edea140fd99e5174a7bc49683875bf0f2fb6d122d42704917740ab515bf16bf34f7fa572824a3599f124a4bd567469dbb258da8652f6
SSDEEP 49152:2El7DpPb/gX+0Wrvl78lPpkVQUX0wCwe8:Hl7NgX58gluVQW5
TLSH
T12675CF03FB8644B1E94E0B3963B7A77FAE359A008324CAD3DB603C5598716D1A63E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Program Files (x86)\GearUP\9271\sentry.dll
Size 426KB
SHA256 4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05
MD5 bf9002bf5c878cdca749025a5f875d6b
SHA1 e916d3121706dbd1ada335b414e4601373b86ef8
SHA512 34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20
SSDEEP 6144:p7HglxMmuzFL2PHajb28r4A/Y7+E/P1cVYr9BeVWiOYaGXQB+r7eY:p7HAx3IFL22707+oKVejeVWiOYaGXQK
TLSH
T13B946B313E15C275FEDA01F6E8FE4FEA896C5965473A01C36AC826957A700D73B3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.dll

Path C:\Program Files (x86)\GearUP\9271\skin.dll
Size 13.6MB
SHA256 cc3f568f7b2f402325713e2a6e2834eb280340f09e736536b40b43d2a64faea3
MD5 e35b9a4463b55b974ac359b9a6e37b6e
SHA1 e657f12af1fb57cfec438b6d233f792e2c8a1779
SHA512 fb2794f6683825d59da677a587208481bc6b59e7fc8453024529ac2525bf37ef7373181cda0baab90a6c7a15bdd6969edc00866c77402b9ee6fdbd1e06d8a84e
SSDEEP 393216:ea9wpJFMxBh348rsR8WypH2wLJnK8Jd6NgNfS:eax34w5nK8fmy6
TLSH
T1D4E612E3F327A994C62B5F352CF75690B437F67E8F21310B6420E6A16DE3AC14A86345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.dll

Path C:\Program Files (x86)\GearUP\9271\ui.dll
Size 1.2MB
SHA256 48dd89d0ee10973965649acc22fb7a2fa9cc0f98534608251fc19e08d9358029
MD5 37a160bbbedb5785c380f831aa49289b
SHA1 bc7feda05e63ba3c14f3913dce6fcc29add41e16
SHA512 e616aa3704cc55e5ec83b18d155cfa00c58a8eec0658af7a9a4aaec32706597e4686f9becfae0e5b1a1a4e5ba990ae88409b6e1d10ef55805d0459e1db903073
SSDEEP 24576:HsiG9UBQQUNYdBE9AqFZjb8t1RVrYyJ4G/:XG9UBQQUWBE9Ar3YyiG/
TLSH
T1115549702E9581BEEF92D177CE3C7B6D24AD92421F2442C371DD0E1D6D624E39A326A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui_webview2.dll

Path C:\Program Files (x86)\GearUP\9271\ui_webview2.dll
Size 238KB
SHA256 dd983e65318b3290574daf8309c53a5706c9f744f4efbcc2fdb44af43cc5cce4
MD5 0cd8b64f29171ccb509565c5e8c7c2ee
SHA1 12045ac3f825724e1d0abb7930ab1cc7eb7105af
SHA512 4c1baf3ede71658435d8c8cce7a2ea881cd8ce628ac87be28c10f2c82b7d463095da0ccb32c840f718bcc566ce7af14ffb2e7976917e9fcaf7e3f451837da2be
SSDEEP 6144:lT6J+APD6jfiBtqpdAbMQb/wbvb0bxb9bMQbzlbZsZuTCnvsdjWdwu5huAdWuBAX:lT6J+o6jqBtq8bMQb/wbvb0bxb9bMQbf
TLSH
T1D0346C317145C639E7DE02B54C6AEBDA12ADB6361FA1C1C7BBC4DE1E0D222D12B31627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files (x86)\GearUP\9271\uninstall.exe
Size 2.9MB
SHA256 35e8b88883fbd447f422930e62e4d4ff46ae3e5a72b41c21496f65666395ca0e
MD5 6772b91aaa595a74ad295edc58b3ecbf
SHA1 f360169239ad04cdf187ad919be4de0108d116d9
SHA512 ef53b768e884a5b290f681ac507f9c83ef33450f510e27b6c027b7ce83056014d8d02f8a814fe1edc6b55aef1a1568a8eb8825f45cea8f8cc8d3cfa2a1de9d3b
SSDEEP 49152:VSYcuw0CYD7Jr9eViMWVZcUjovDP/n8wJUbJMGtmARpk/pFMbRd94LnCxgv2:VSXYJr9eHQaJUbJM3AE/HMV
TLSH
T1A1E5D012FB868072E567073555BAA77B9935AE200334C5C3F7A53D2C58706D2AA3F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Program Files (x86)\GearUP\9271\update.exe
Size 3.3MB
SHA256 71769894cfefc9d38776ea758f82f392615d1319f2678808b0b88dbbe2859847
MD5 d04808eb51076e23a48ae0fa7bd93d44
SHA1 3ef2358532ca497ffa154f5200717cc8f63b98c4
SHA512 bf6901b14026531831c454cb2a091ea3522acca945367caebcdb607f65463bd954cef6b6d309d5edde34f83e6655f93ff8b296b3d2b01bfa9ab07b9462fac66b
SSDEEP 49152:wxzWxg94peo1jbbr/5uxCRyT863YeYxLMPCUIViccUpkCs1CRT+zCcQQKku4FA3t:w09F7yA63YPLICUYiccbNo+emKp4FW
TLSH
T1C7F5C012AE878072D55F06745DBE97BBC939AE21133485C3E7AF3C6C18705D2AD3A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\GearUP\9271\vcruntime140.dll
Size 88KB
SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
MD5 81b11024a8ed0c9adfd5fbf6916b133c
SHA1 c87f446d9655ba2f6fddd33014c75dc783941c33
SHA512 e4b1c694cb028fa960d750fa6a202bc3a477673b097b2a9e0991219b9891b5f879aa13aa741f73acd41eb23feee58e3dd6032821a23e9090ecd9cc2c3ec826a1
SSDEEP 1536:ckch/beb1bBhdXPFSAS7wIVktX8/eZT2G//ecb2Z0X3I+zl3z:ck2+1blXPg7wIVkts/UF/ecb2a5F
TLSH
T14E937C02B5D48071D9BE18B643A9D6027A7DB3A14FD60AEB5FA59CC89FB57C0E730207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\GearUP\9271\zlib1.dll
Size 77KB
SHA256 b9cbdf114c7c403d844550c12d7dd8c755cd58b5b4f99135d812bafd444364ac
MD5 e3523734f05af14a7b74bc026e3d31b1
SHA1 bc54a7b2adde2004903840ed8279e8b975c67fc2
SHA512 1c81bf56978e86299fa21573e6a6cfe942b7289ecb8e7ee4b1a67af3639d1b45d4274f00f35a0cff4d0e75da420e9fce4183ef439ff9cc62914f3df563a27104
SSDEEP 1536:z77FCOWzicqQPFwYZEABJx98se//002UldXfyIOsIOpcKjKr:TFlWWQuaEsJ0JbXfQipcKj
TLSH
T113739D41AB9143F5D4F5017681F7472DD63630208B87ECEBE28DB6E988127D1AB362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
Size 589KB
SHA256 0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035
MD5 c6d72642721e84d227defc3ec4ab12e6
SHA1 3709a7c3cc795a0012adc6ccaf82a93628703518
SHA512 fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389
SSDEEP 12288:qwW5Af1q9Wq0/rxaxQhlS/a4zdFGDyV+LrnYkdcmE1GN6:qwWO+BElQa4xFGe2rnYkdcb1
TLSH
T1FBD48E133AF5C0BED6620530CA1E6BF5A0FA97680B2248C767D08E1D1B798D5C636E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.zip

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip
Size 28.9MB
SHA256 f490312b4a25ffbeecf991144180cb53ed7385e783a2e924ef29f52e36a1921c
MD5 976f177c6c2aa055949e85580ab0d3ab
SHA1 9b60e6c0ce58aff080c383da961bc1e1e4edc517
SHA512 e193904fbf910665be4b922697c61d514b8ce82c602fca38f36a00ae37014f2d26d9b5d53a3321d1bf911a196a8d579ce3a30a2559e6afde6d228d83de4c6a24
SSDEEP 786432:Xky94UL7kslO8Tte3JpJvecc5iZnRS7zUJu9yIv6WKM:YULY7OgZfpVQ7zUJu9Rv6WKM
TLSH
T1386733D98363A895092E6803D2B91F88539EE997DBC7EA13351F4099EC074C391DED8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files (x86)\GearUP\launcher.exe
Size 1.7MB
SHA256 ec25bf5c9461a94bd3dd665798c45ebc2f86a0e04051b86ce9bb2c4dbf64f397
MD5 38b0fc95bf3f5ff938d204785f85442c
SHA1 c4977d2d78cddf80599c30cdb6583bf34695af37
SHA512 2b6909849a7725fea39eebe65c34995839c08b82dda5c81da11ae7843a68ca67c0bb6b3082f40712eebb2fac92353b68b170eae7d3ad1af3fcc25f5787a6cceb
SSDEEP 49152:24JmPG4iH+/3/s9JB0dYhVYTpk5WjsSdHZ9:26+/3+v0d2Yykjb
TLSH
T1CD85AF02BE8784B2D84E0A399DBF977FCA35AA114335C6C39B5F3C5458212D25E3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GearUP.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP.lnk
Size 1KB
SHA256 60c3abda8eeb5d34e02193ecf72159db6ccffd90ce821d79d5149cf9303ed190
MD5 e55049672400507f145875a010687735
SHA1 f40bd88f08cc535ee02269f81e2020df8dca8205
SHA512 e2be2b0d95f091f964a6ad19540503bf3b95fed6710a2045664a2daff7bbba02e2b37a1a408b410a4de06aacfcf6a9439d7cad9942c5559a45bc85e20c59d82a
TLSH
T142417F080FDE1729F33397325D7A46623533BC01F7650B2E4295C74149FA5196AA8FBA
MD5 SHA1 SHA512 TLSH

Submit Download

gu.log

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
Size 1KB
SHA256 e708c7e1b18a70dbc5671946ac3ea4af3a9d3c7f8b6355b6b09a475625eb96f3
MD5 6e1e6fdfadbb005b5482491ef83425db
SHA1 21120f19433e2e94e2f47bbf8a2e9734965da227
SHA512 92d0744b80f3bb813a95c3f6df522045be6b57e194e71e1210de5bd710b3e502ef83447240375a83245677801462a8fb243cfa4e9296d746ab5862449b4306f2
TLSH
T1603174DE053819A529AFC967B63C0A21D5506A3AC687BE4300EB8BD943EEDD07642401
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ad7d6b2ae801b5f5cbfc2f5826d1053f4b967fc86e18d9fedbe7ca29b30dc2d6
MD5 1bbe79a462eb06fcb30f8e38b2bd5d49
SHA1 c0fcc58127f27a8d6d8e4401cd53690f1c37e5cb
SHA512 2fc93c0a37536a40123d929c8597a0bdef2a8def9f12e73c1dbbc84c48beebd32dca40bb473c2a104e428e254cc7370ba1f94113a6e656bd56c875f76c8d9aea
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6c95b8ebe7ff2f8ae1246f4869aebccbfec8dcd1d653e8d871677c121f21a656
MD5 81214dcc91aec3209eb102cd49df3ca6
SHA1 ffa380038d4ba81dc01f98ff3b56f055f97566fc
SHA512 0291a43c64ff319cc5fe9a724e83fa65ec8da396679c7a34c16ffd9ff61bef98b5af3f5c22362d3729ca2fae38ce4efe29a5ef4a538d4893048d733442695202
TLSH
T1F5D0241733314334C01070330043F14D0541C30F4405C000D43CCD1D5FD40500D13455
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

57d4f781-0dd3-4737-ba42-268bf82c6199.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\57d4f781-0dd3-4737-ba42-268bf82c6199.tmp
Size 5KB
SHA256 69d802840035b09acaaa98782b8a173441e854c8d58609033455e7e717c4f5c2
MD5 74138731661c08b24f55319c3319ce9c
SHA1 1604f0715d8f10e8a6567562dddc72f4fe3778c3
SHA512 5de45d9bd28d3f0790e10ce9ba8aca97e91bce307c4549081bf78addc0f381bb65c6eb61d3f87d33d17f805d11e6f4f606e7ff5ea81c06cce41cfcd5b7edd188
SSDEEP 96:rve/dKYnf/p//b9t/k86do616ZZs7/x+6MhmuecmjewQK+gpaNtT+28XM2C7K:rvmwYnnxv/ncojsV+FijT7/aNtT+GDK
TLSH
T108C196025A28B8BB4CCAE50DBA397A43E2F5543235D52D5CEBF8462C08DB5CD6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
Size 5KB
SHA256 3150111affff4c540cbaa150cb001872d1e7f49eba331ef4b7fee0780d0364de
MD5 438cd7c2e1ba86fa2021390455ae8704
SHA1 b59a6f78116cb8483e0404b37210f209b1dc3a48
SHA512 3d7437d271c94f638fa782d79c6442c757c8b3f3060561fcbc8df401743c7006944f9a13a3adea10df06ef275d8f279f550c45069811cbe70be7918cdd4a10ce
SSDEEP 96:stve/dKYnf/p//b9t/k8Ao5h16ZZs7/x+6MhmuecmjewQK+gNa4tT+28XM2C7K:stvmwYnnxv/nAo+sV+FijT7Ta4tT+GDK
TLSH
T110C195425E28B8BB8CCAE509BA257A43E2F5643220D52E58EBF8461C08DB5DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
Size 5KB
SHA256 3d569365caa5dc8932250e3571a28172ef44310a93c7fd95525dc5a0b008d90d
MD5 4758f33af3a30fe2a73e3088c616c068
SHA1 ee8dfbe9dd919e6c9cb5303a5f77c8c15d2fa591
SHA512 03ddeb15edca071b8d45d82141c2c6a3e9d0b1a47c7f53ab6c6c25eeaf6e912947ea73a7e0b2c09d58270b57292003505feee3e1408b24194f85521a2cac4976
SSDEEP 96:stve/dKYnf/gG//b9t/k8Ao5h16ZZs7/x+6MhmuecmjewQK+gNa4tT+28XM2C7K:stvmwYnnrv/nAo+sV+FijT7Ta4tT+GDK
TLSH
T113C1A6425E2878BB8CCBE519BA297B43E2F5603260D52E5CEBF8461C08EB5DC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 2KB
SHA256 c6bbd3497456e66f159e85289056146094aeb7cedf77c6f451aed1d5e936912a
MD5 6c1b99194262abc46d1fa23c0105aa5c
SHA1 483bc9c83da63dc12b3c5d962875709e6b82e483
SHA512 d25d7d14b91438028b0caebe701ab825e326a5735579a1a4240d1d0017a6dfccc303e7c843246abe8b94a632ade1afec682799dee3a37c18b9c98b3976a83366
TLSH
T1D351A773B955AA73C9F34A09798A3B63DE7950A29E132F109EDD0B0C009755C2343C73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 3KB
SHA256 6d2131fd514fc1dadfc0b5e72a5466df891683ca6db3aaf3ddf5c8293d29e39a
MD5 7e63cc472a11099b068f9c68cbe3a4e9
SHA1 df1af82976a869b59016bbd047a8e8d6bf99667d
SHA512 1cfa0ddff51f258ee4b7a1b87582c1a8a57d581db7ee09d6595bb2fa09bcea6aea866e2a854008b480df8130c8ef315a075f18682947c03fd4bb15b61f0be63a
TLSH
T167618537A9A5E9778DF39A05B9862B13EBA55023E9863F54DAEC0F0C00D729C1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 3KB
SHA256 1c8b0072f2bb7b8e048900184491a3380471c543ac834bb684c030d67e355ec0
MD5 20e75ee4d40033ad361d7b39770451e1
SHA1 476c7dabe6308712e07f227603f2a8b055d92f32
SHA512 2ae9357e9e93a4c89b7ae4229db0d9daea7985dd81e8bc175efd87d7af2f49a37e59a0e5c94e0afd4083601a0f4df3d73be0533c6e246c3806c43705ac2453c1
TLSH
T1BB71B7376975A9378DF39A0979863B53A7A45023E9863F99CAEC0F0C01D739C1342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 16KB
SHA256 ef3763b44b1987d18edf3090a0debf291812b2243dc6c63c8304d798ef05a64d
MD5 beb548ddf60f3abdfb9d427b5ac9f8c0
SHA1 7ee259da315309755956de49cc34a9e3ab25b367
SHA512 e94fe0c95ed50b12e6fafc22a89581d83c5d06739449aca80f940095390a067d48a1b41377d54416d773aac48d63f4278698488ed64f746a62d6188a92849e7f
SSDEEP 384:n+aQikB+z/xvxjg/qhEwNBSgcYA5F4VRCx9zi:2/UxvxjgC+BnF4VoFi
TLSH
T19A729E3B9865BE2398F7A6413A4A67CBDBF4547254C66AE88EED1F0D06C36DD1342C03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a399.TMP

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State~RFe59a399.TMP
Size 1KB
SHA256 24776a864899121a81b312f098c0c5572968fa61d7f8f43c14531ec01abc6b5f
MD5 0dfc6dda82cec9e96f94077d899ff4f2
SHA1 be2afa7d19934cab6e3b4a271028f33382fa4fcd
SHA512 4af43a6b9924ed2e6f72fe1b1cf194b1d94e3f971c99c73f91001078b54d260f685c3e6cbd86d55ada1ed74a93bb180f452cc5f0339df3a009af9e3982830142
TLSH
T1692165B3E5A55B72DC9626073246AAA39F74107786028E049AEE4A1D019B1AC6757C32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_123850625\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_637046473\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

memory/1052-437-0x00007FFE4E340000-0x00007FFE4E341000-memory.dmp

Download

memory/1204-582-0x00007FFE4DEF0000-0x00007FFE4DEF1000-memory.dmp

Download

memory/1204-581-0x00007FFE4EA00000-0x00007FFE4EA01000-memory.dmp

Download

memory/1800-0-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/4200-456-0x00007FFE4E340000-0x00007FFE4E341000-memory.dmp

Download

memory/4316-633-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-631-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-636-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-635-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-634-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-632-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-627-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download

memory/4316-625-0x0000019A44DE0000-0x0000019A44DE1000-memory.dmp

Download