0d8f9eafe732b21ddb3ced43ddc4b6a2df2de088e68346b7c994cb88a7291565

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Size 34.4MB
Sample261030-esttvsav8m
SHA256 0d8f9eafe732b21ddb3ced43ddc4b6a2df2de088e68346b7c994cb88a7291565
MD5 57686fcb1b31272014cf6ab753d28687
SHA1 07c52150af4eddac6e4b21f545b94cc75d081dac
SHA512 cc9b9275bd9351e4dde39374f6087e623e3880b2784b4b072b2eefc464b2b9c00dc43d47f08bd16bd2448a815ee8ce1feefd0315c049939b9ea79c5cd1b5abcb
SSDEEP 786432:VBEI+P2WeR1INMe8l1++1Uo2ZOoYfBtdm0H1gUb8EU05C:HEKXM2l1+b/sBtdVOUb8gC
TLSH
T17C873312FF878072E59B0530567DABBBC97AAF300735C5C39785392958309D29E3B36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	gearup_booster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\protobuf_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\lspinst_x64.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wfp\win\x32\gunetfilter.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\kcp_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\arm64\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-locale-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wfp\win\x32\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\ws2detour.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\VisualElements\SmallLogo.png	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\tap_driver\arm64\tap0901.cat	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\x64\NW_TAP_0921.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\ui.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\wfp\win7\x32\gunetfilter.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\lanplay_tun.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\skin.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\shence.log	gearup_booster.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\i386\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\x64\NW_TAP_0909.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\tap_driver\x64\NW_TAP_0909.inf	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-convert-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-environment-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\ws2detour.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wfp\win\x64\gunetfilter.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\hostfp\64\hostpacket.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\VisualElements\Logo.png	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\ngtcp2-LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\x64\tap0901.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\gearup_ball.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\tcp_proxy.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\zlib1.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wintun\LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\zlib_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\arm64\tap0901.cat	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\ws2detour_x64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wfp\win\x64\nwwfp.sys	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wfp\win7	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\gearup_booster.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\lunasvg.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-stdio-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\local_proxy.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\license\lgpl-2.1.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\license\protobuf-lite_LICENSE.txt	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-convert-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\ngpush.dll	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\dui_webview2.tlb	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\i386\NW_TAP_0921.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\api-ms-win-crt-multibyte-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\UniSDK\NGPush\uuxxgu_2_c834c170.json	gearup_ball.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\tap_driver\arm64\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\gearup_ball.exe	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\wfp\arm64\nwwfp.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\VisualElements\Logo.png	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\gpl-2.0.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\winpacp_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\tap_driver\i386\NW_TAP_0909.sys	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\tap_driver\x64\OemVista.inf	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\apiinstall_x64.exe	7za.exe
File created	C:\Program Files (x86)\GearUP\9275\config.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\config.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\license\netfilter_LICENSE.txt	7za.exe
File opened for modification	C:\Program Files (x86)\GearUP\9275\tap_driver\arm64\tap0901.sys	7za.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_1789501345\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_1789501345\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_1789501345\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_1789501345\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_1789501345\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\Part-ZH	msedgewebview2.exe

Executes dropped EXE 6 IoCs

pid	Process
2988	7za.exe
3296	launcher.exe
1588	gearup_booster.exe
4212	crashpad_handler.exe
5252	gearup_ball.exe
1204	crashpad_handler.exe

Loads dropped DLL 24 IoCs

pid	Process
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
4212	crashpad_handler.exe
4212	crashpad_handler.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
5252	gearup_ball.exe
1204	crashpad_handler.exe
1204	crashpad_handler.exe
5252	gearup_ball.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
5724	WMIC.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gearup_booster.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	gearup_booster.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000c00000001c5d7-309.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe
5640	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gearup_booster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gearup_booster.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gearup_ball.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gearup_ball.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_booster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gearup_ball.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	gearup_booster.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gearup_booster.exe = "11000"	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\URL Protocol	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell	gearup_booster.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open	gearup_booster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gu\shell\open\command\ = "C:\\Program Files (x86)\\GearUP\\9275\\gearup_booster.exe \"%1\""	gearup_booster.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5724	WMIC.exe
5724	WMIC.exe
5724	WMIC.exe
5724	WMIC.exe
1588	gearup_booster.exe
1588	gearup_booster.exe
2528	msedgewebview2.exe
2528	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2804	msedgewebview2.exe
2804	msedgewebview2.exe
2804	msedgewebview2.exe
2804	msedgewebview2.exe
2804	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	2988	7za.exe
Token: 35	2988	7za.exe
Token: SeSecurityPrivilege	2988	7za.exe
Token: SeSecurityPrivilege	2988	7za.exe
Token: SeIncreaseQuotaPrivilege	5724	WMIC.exe
Token: SeSecurityPrivilege	5724	WMIC.exe
Token: SeTakeOwnershipPrivilege	5724	WMIC.exe
Token: SeLoadDriverPrivilege	5724	WMIC.exe
Token: SeSystemProfilePrivilege	5724	WMIC.exe
Token: SeSystemtimePrivilege	5724	WMIC.exe
Token: SeProfSingleProcessPrivilege	5724	WMIC.exe
Token: SeIncBasePriorityPrivilege	5724	WMIC.exe
Token: SeCreatePagefilePrivilege	5724	WMIC.exe
Token: SeBackupPrivilege	5724	WMIC.exe
Token: SeRestorePrivilege	5724	WMIC.exe
Token: SeShutdownPrivilege	5724	WMIC.exe
Token: SeDebugPrivilege	5724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5724	WMIC.exe
Token: SeRemoteShutdownPrivilege	5724	WMIC.exe
Token: SeUndockPrivilege	5724	WMIC.exe
Token: SeManageVolumePrivilege	5724	WMIC.exe
Token: 33	5724	WMIC.exe
Token: 34	5724	WMIC.exe
Token: 35	5724	WMIC.exe
Token: 36	5724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5724	WMIC.exe
Token: SeSecurityPrivilege	5724	WMIC.exe
Token: SeTakeOwnershipPrivilege	5724	WMIC.exe
Token: SeLoadDriverPrivilege	5724	WMIC.exe
Token: SeSystemProfilePrivilege	5724	WMIC.exe
Token: SeSystemtimePrivilege	5724	WMIC.exe
Token: SeProfSingleProcessPrivilege	5724	WMIC.exe
Token: SeIncBasePriorityPrivilege	5724	WMIC.exe
Token: SeCreatePagefilePrivilege	5724	WMIC.exe
Token: SeBackupPrivilege	5724	WMIC.exe
Token: SeRestorePrivilege	5724	WMIC.exe
Token: SeShutdownPrivilege	5724	WMIC.exe
Token: SeDebugPrivilege	5724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5724	WMIC.exe
Token: SeRemoteShutdownPrivilege	5724	WMIC.exe
Token: SeUndockPrivilege	5724	WMIC.exe
Token: SeManageVolumePrivilege	5724	WMIC.exe
Token: 33	5724	WMIC.exe
Token: 34	5724	WMIC.exe
Token: 35	5724	WMIC.exe
Token: 36	5724	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1588	gearup_booster.exe
5252	gearup_ball.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1588	gearup_booster.exe
5252	gearup_ball.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 2988	5760	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe	91
PID 5760 wrote to memory of 1580	5760	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe	93
PID 5760 wrote to memory of 3296	5760	2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe	95
PID 3296 wrote to memory of 1588	3296	launcher.exe	96
PID 1588 wrote to memory of 4212	1588	gearup_booster.exe	97
PID 1588 wrote to memory of 5640	1588	gearup_booster.exe	98
PID 5640 wrote to memory of 5724	5640	cmd.exe	100
PID 1588 wrote to memory of 2804	1588	gearup_booster.exe	102
PID 2804 wrote to memory of 1396	2804	msedgewebview2.exe	103
PID 1588 wrote to memory of 5252	1588	gearup_booster.exe	104
PID 5252 wrote to memory of 1204	5252	gearup_ball.exe	105
PID 2804 wrote to memory of 5908	2804	msedgewebview2.exe	106
PID 2804 wrote to memory of 5908	2804	msedgewebview2.exe	106
PID 2804 wrote to memory of 5908	2804	msedgewebview2.exe	106
PID 2804 wrote to memory of 5908	2804	msedgewebview2.exe	106
PID 2804 wrote to memory of 5516	2804	msedgewebview2.exe	107
PID 2804 wrote to memory of 1196	2804	msedgewebview2.exe	108
PID 2804 wrote to memory of 1196	2804	msedgewebview2.exe	108
PID 2804 wrote to memory of 1196	2804	msedgewebview2.exe	108
PID 2804 wrote to memory of 884	2804	msedgewebview2.exe	109
PID 2804 wrote to memory of 884	2804	msedgewebview2.exe	109
PID 2804 wrote to memory of 884	2804	msedgewebview2.exe	109
PID 2804 wrote to memory of 884	2804	msedgewebview2.exe	109
PID 2804 wrote to memory of 884	2804	msedgewebview2.exe	109
PID 2804 wrote to memory of 2968	2804	msedgewebview2.exe	110
PID 2804 wrote to memory of 2968	2804	msedgewebview2.exe	110
PID 2804 wrote to memory of 2968	2804	msedgewebview2.exe	110
PID 2804 wrote to memory of 2968	2804	msedgewebview2.exe	110
PID 2804 wrote to memory of 2968	2804	msedgewebview2.exe	110
PID 2804 wrote to memory of 4848	2804	msedgewebview2.exe	111
PID 2804 wrote to memory of 4848	2804	msedgewebview2.exe	111
PID 2804 wrote to memory of 4848	2804	msedgewebview2.exe	111
PID 2804 wrote to memory of 4848	2804	msedgewebview2.exe	111
PID 2804 wrote to memory of 4848	2804	msedgewebview2.exe	111
PID 2804 wrote to memory of 1812	2804	msedgewebview2.exe	112
PID 2804 wrote to memory of 1812	2804	msedgewebview2.exe	112
PID 2804 wrote to memory of 1812	2804	msedgewebview2.exe	112
PID 2804 wrote to memory of 1812	2804	msedgewebview2.exe	112
PID 2804 wrote to memory of 1812	2804	msedgewebview2.exe	112
PID 2804 wrote to memory of 1244	2804	msedgewebview2.exe	113
PID 2804 wrote to memory of 1244	2804	msedgewebview2.exe	113
PID 2804 wrote to memory of 1244	2804	msedgewebview2.exe	113
PID 2804 wrote to memory of 1244	2804	msedgewebview2.exe	113
PID 2804 wrote to memory of 1244	2804	msedgewebview2.exe	113
PID 2804 wrote to memory of 3760	2804	msedgewebview2.exe	117
PID 2804 wrote to memory of 3760	2804	msedgewebview2.exe	117
PID 2804 wrote to memory of 3760	2804	msedgewebview2.exe	117
PID 2804 wrote to memory of 3144	2804	msedgewebview2.exe	118
PID 2804 wrote to memory of 3144	2804	msedgewebview2.exe	118
PID 2804 wrote to memory of 3144	2804	msedgewebview2.exe	118
PID 2804 wrote to memory of 2528	2804	msedgewebview2.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_57686fcb1b31272014cf6ab753d28687_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
  "C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUP\" -aoa
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUP\gearup_booster_temp\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1580
- C:\Program Files (x86)\GearUP\launcher.exe
  "C:\Program Files (x86)\GearUP\launcher.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶㑥㤱㈴扥㕥昹〰挷㙡昹㐰۞ዸ۞锍箵ഀ蠀
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Program Files (x86)\GearUP\9275\gearup_booster.exe
    "C:\Program Files (x86)\GearUP\9275\gearup_booster.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶㑥㤱㈴扥㕥昹〰挷㙡昹㐰۞ዸ۞锍箵ഀ蠀
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Direct Volume Access: Opens a physical disk for reading
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Program Files (x86)\GearUP\9275\crashpad_handler.exe
      "C:\Program Files (x86)\GearUP\9275\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lanplay.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\0776fa00-dbc7-4865-3664-ec6adc65a93a.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\0776fa00-dbc7-4865-3664-ec6adc65a93a.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\0776fa00-dbc7-4865-3664-ec6adc65a93a.run\__sentry-breadcrumb2 --initial-client-data=0x4e4,0x4e8,0x4ec,0x4c0,0x4f0,0x72df5160,0x72df5174,0x72df5184
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic csproduct get uuid
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5640
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Queries system WMI classes for hardware identifiers
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --accept-lang=en --enable-features=MojoIpcz --force-device-scale-factor=1 --lang=en --mojo-named-platform-channel-pipe=1588.3064.1957396662050154258 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x50,0x7ffd4cf35fd8,0x7ffd4cf35fe4,0x7ffd4cf35ff0
        5⤵
        
        PID:1396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:5516
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2540 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3236 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:884
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3580 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:2968
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3768 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:4848
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3936 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --force-device-scale-factor=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3964 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8 /prefetch:1
        5⤵
        
        PID:1244
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4924 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:3760
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4980 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        
        PID:3144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=3.5.1.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5396 --field-trial-handle=1764,i,12598745580408985072,10458137961323210384,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ffa103d895f001a793df6b459350afd7e265caa8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2528
  - - C:\Program Files (x86)\GearUP\9275\gearup_ball.exe
      C:\Program Files (x86)\GearUP\9275\gearup_ball.exe /main_form_wnd 721350 /show_flag 0 /pos_x -1 /pos_y -1 /version 9275 /client_id 6ae4194c2c750c171098eaaf /gray 0
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5252
    - - C:\Program Files (x86)\GearUP\9275\crashpad_handler.exe
        
        "C:\Program Files (x86)\GearUP\9275\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\f918d051-b755-4059-f270-84db14b209e2.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\f918d051-b755-4059-f270-84db14b209e2.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\f918d051-b755-4059-f270-84db14b209e2.run\__sentry-breadcrumb2 --initial-client-data=0x4a4,0x4a8,0x4ac,0x480,0x4b0,0x72df5160,0x72df5174,0x72df5184
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NGPush.dll

Path C:\Program Files (x86)\GearUP\9275\NGPush.dll
Size 6.7MB
SHA256 bd3a87dbb6199c0a8b486e779454743b7cfa845e96069ceeca002d4d1f0cdc27
MD5 3f8752a0eaf92532dbde97e93ff6f762
SHA1 3e0ab23e1b0daa7b0be9e9d3a382caf1b41c0f47
SHA512 a9c1bde7835c76c4cc719082f469881a31d81e12c7d11e8900e7bfd45eab46f1053fa7907cb7ac1a209fc1c321711e2bcd411d2836288dade6bd383781709150
SSDEEP 98304:yvky8kf7yeV4fZiu+nETmnZeGA14uu+Pb4G0hqB6SJ1yh6:Wkcf7PeTjSvSz
TLSH
T1B066B022BB568161EACF41BA55BE6BBF4A3C4A144B3540D3D6C42D6ECD305C23B3E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uuxxgu_2_c834c170.json

Path C:\Program Files (x86)\GearUP\9275\UniSDK\NGPush\uuxxgu_2_c834c170.json
Size 512B
SHA256 75d5e1e5ac10288e932b011683d34f1bd05a6da78bd70db59a25fab3334c71d9
MD5 051f002c8f717027c0fd100b57d272ce
SHA1 917748511d2d5f2ebc10386d7deb64bdb972d3aa
SHA512 aa5ec2efeffe9925eb3b88b72f58de5e39ba417a41a079b6213cbafea12999ffc3ab4bc222f137a42d59e0ef528da64614d5970cd1df1efcd41b8e759335d8e3
TLSH
T1D1F02081F2608A44A237806B79E878440DA41DA1A5F0571920E19A312C46668AC2EE75
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files (x86)\GearUP\9275\WebView2Loader.dll
Size 113KB
SHA256 4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c
MD5 999f67ef1a2d06beeaf85ec9b5d5d73d
SHA1 644b1768f8675b29fb53a51edb5d344fdf55946c
SHA512 6399fda1c54bd26ce82b7d48ac1b7c9741d5abf68a67bd62ec53ea2a1f82caac2e9bfdb1cb22f5af3c8ca6f4789a888f6519e02941f6c33f6f9d3b0e58eb56f4
SSDEEP 3072:OnbFYqJx7sXRq2KVs9iiamgqeNZPTj7EtJlAlHJcgf4fm9pS:OZYqJx4gkYiavEtJe9f2mbS
TLSH
T130B36B5176D08072E9BE0A380874DB655B3F7960DFA09DEB67845AA94F317C0CE34E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.data

Path C:\Program Files (x86)\GearUP\9275\cache.data
Size 659KB
SHA256 703416e76dab7533ae17dda80bf9a799a0fcdb6d02bcdbe6db3ab1bf2c76419a
MD5 ea40f9cb1b7f7f3050065e6681273931
SHA1 ec21a0112c34ed163963dc70ab094d2320ad21cc
SHA512 d094fef34dc0c27c6b69152041a218c2be15c66451a33773e1730323cf9ccb47b0fdea173e20c7718eb5159415db204fab6f150e4296f181e147ce391b49c127
SSDEEP 12288:eqLUR18TlBjpHDrT6B7WV0laCXYtSn/zjxHfDGq1+WCYYiBeFQWk1KwafPwp/y:eeO1clBjpG7YCX9LjFfDTbYaeiWxPG/y
TLSH
T13FE42328844D8B669A827C3A976B3625CDB1B6C7D474BB110088FC209FE655FD5B0F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files (x86)\GearUP\9275\crashpad_handler.exe
Size 853KB
SHA256 80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150
MD5 5a243339440082631749f4bdff283bf5
SHA1 4c3512320b1b3c05ce265037a37aa3f16d3cc57c
SHA512 c0b889a819ac5cc6904caeb37e504e6a50d33e49a0e6fb6bdaf8e372190c9bca021017103a7dfcedf7e2c8d9c6a1f3eef103cdf389a5f6bb9ff71f03783ebe24
SSDEEP 24576:CLblY9+TeiDrZAdMgz3QZ5qY0xTHeMjoOvQdp89T7a0DPafB:0l7xKWnqY0xTHeMjoOvQdpCT7a0C
TLSH
T1F0057D307E1AC135EE5201F389AC6BEB81AD951A8B7706C361C8576D6A742E33F33917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcount_wapper.dll

Path C:\Program Files (x86)\GearUP\9275\fcount_wapper.dll
Size 675KB
SHA256 1769c0dae8f211b33784be128c778d8753f71dea28874d0a3034622f4ce00f80
MD5 c59ee7906a64069f8b63dbf86b9bddfa
SHA1 2b7fb8ee33125eaf36405f87501e54bbee90ffef
SHA512 b1b4b7759256689faf52832330b56c331824d131fa847feba501320f0c6ec3a89a4ebec8f9401f5596abb4be7a4cc419bfd799c8bb031a043af13359ad5fa999
SSDEEP 12288:AcjH+4SKRvLcAG6UXoakH8cmC0yNDZTgEHx:Acj+4zJogUXlEX0yNDZ1R
TLSH
T1EAE46D209640E136F8BF0076DC7D869E605C6B31076444DFB7C8AE5AAEB66C1BB31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_ball.exe

Path C:\Program Files (x86)\GearUP\9275\gearup_ball.exe
Size 1.8MB
SHA256 e4757b9a32b56bba90cf1daa4a077ab7bb0fc25141ffde3925b79e11d543a376
MD5 8fafbf754b28d971a9ca4a748c4e3783
SHA1 3fd73858756045a3c920411990db10666c073bd9
SHA512 c78601ebeba363872d8d021d9c3ee5d6419d3f4f5430ae9fbe8b033f7cb2fa53f46e2c62ac152d437b4beb74876e827c783aa4355c49e7c28b760ba13c0df4c5
SSDEEP 49152:TrNBkCJqWZYjIZmZzkTpa6TySPNQLFEzJsz0:/fJKEZmZ4Ly6QLc
TLSH
T14F859D11AE434272E99F02B55DBE977EC935AE200338D5C3C78F3C6588756D22E3A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.exe

Path C:\Program Files (x86)\GearUP\9275\gearup_booster.exe
Size 10.6MB
SHA256 6346f333d59513f9f07048c52bf44f1a876801f9f6b1e13ede0b51ef975f8edb
MD5 5448b2a65045cd5038e46476733e30ba
SHA1 0ec07def78b470c774cbe00067ad3dd2d3c92086
SHA512 8fa47437e0457eb7c61911060422653d119ef8cb33219b67048e24a24af38ea843cab08d72643229fa9426d986e51baff80b2d8e27287413f7f8b2242da8bef0
SSDEEP 196608:VvTEqvZPDYJmCnntQFsxIR54R9owyq6UyW:rMntQFsxR9owyrUv
TLSH
T180B65B127AD20029F9F706FB99BC9A5984BD7D61172DC4C7C389388D8466DC26E32F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files (x86)\GearUP\9275\libcurl.dll
Size 5.5MB
SHA256 028dfda38f9aa9bbed5ca3ef6a67cd66ea5e44d68b7781d9717b35b138115fe8
MD5 745b206e518eea5b73bfed7631ccbc9d
SHA1 4422c68c5939833a5fd6169f7c05fed2bfec6f7f
SHA512 8406cef16c550e995fd1e744f59a8fa2c557e9eccd4de6e6ccbecc317fbab46f601f0280ef2b53daf6e3b37b320888443738b3336467146157e527501b07f02a
SSDEEP 98304:0cGYaW1dJbQbLC9b00oA9/4uAxCarTSbcV5:0+aiZoGTH/+xvmQV5
TLSH
T15B46AD17FF8266A0E9CE427E12FF6B7F4D3A5A18972494D38A5128E8C8716D1733E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun_LICENSE.txt

Path C:\Program Files (x86)\GearUP\9275\license\wintun_LICENSE.txt
Size 5KB
SHA256 183adac21e7d96c508c8fd34d394b7b6708bc81564ad1bad61ab66143a008cd2
MD5 95b8440eb9cd85658a460096a0b71388
SHA1 4f1a6ca95b36e8d8d007bfb67279e44b4be9b71c
SHA512 104553ad2192596a10afc61640f17e92502b382b170057d648f8496ae95f8dfa62dcaa825319b8b5efef5202c07272c8d59483ad8e5af16f0472ad1e385c8f53
SSDEEP 96:2e07cvMsHG9BZkNx60FPjbpyXNHdZRb3mpAdd7AcgOvdKpVpPqNp2pPU4/746:VkcksH6aNx6uj9yXNHdr3mpAdxg61p23
TLSH
T145B1E7997B4A13B225B083BD677234C1E32F813936BE6585324C814D3F75E3581F96EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lunasvg.dll

Path C:\Program Files (x86)\GearUP\9275\lunasvg.dll
Size 484KB
SHA256 6a6991d8d36530b566c98324db4fce30fdf834f9db6291bc1f27443d4d280c56
MD5 5b4fd4e5171e635a0adbaf46396c54e2
SHA1 d2d10ffe8a85f28b35071a327a053543ce26a230
SHA512 dac6a5ffba6c0ec46086309bd4feb7b8f90d22c25e8081fc6089d78f89b2fed98d8f50aa586ab6e4a23eee11c05fe4ef57215ca92a80b913467f1aebd56df500
SSDEEP 12288:E6JcA+NdGkkSEvhf2g1LKYH5HMHt/yGdC:E6JcA+pkSahf2KLKYZHCtd
TLSH
T17DB4AE32B822C271F9D912F1F9BD6FAF55396E2007AD4AC367C848A5C5609D367B3243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\GearUP\9275\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ping.dll

Path C:\Program Files (x86)\GearUP\9275\ping.dll
Size 1.3MB
SHA256 dbff42dd71cc23b629dc793a6739c3fab47022a6acb152d3234ddbb02b8c3193
MD5 c08d6980e6ef4945ab84690c5adf3840
SHA1 b510295df56a1ea701d8486f00ede6f994ff9e9f
SHA512 c623cab268361ed8fe01528568104226ca3ed6f180065f7ba6e7cf6a657da0e67d55d02a06666b4a8c6553efbfd3868421a40afbd47b094625c455fed41ce4b1
SSDEEP 24576:Cr7VLpsGX/X2xdyjK0BwxB9QiuR2s0bMNgAJDvpklx2SPfFX6PlYSJV:Cr7VLpsGX/X2CiKBJDvalx2SPfFSlYS/
TLSH
T1CA55AF02FB4256A2E58E42B86177AB7F8D3A5E244724C5D3DF813DA68C312D1673F389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Program Files (x86)\GearUP\9275\sentry.dll
Size 426KB
SHA256 4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05
MD5 bf9002bf5c878cdca749025a5f875d6b
SHA1 e916d3121706dbd1ada335b414e4601373b86ef8
SHA512 34873e1bd9c077046469db3a2176581aea162933c39c51f1ded462030fb2238a93b3d7e20ff14a497be42e019f2f23add141d98b662b395618bf69ed74a90a20
SSDEEP 6144:p7HglxMmuzFL2PHajb28r4A/Y7+E/P1cVYr9BeVWiOYaGXQB+r7eY:p7HAx3IFL22707+oKVejeVWiOYaGXQK
TLSH
T13B946B313E15C275FEDA01F6E8FE4FEA896C5965473A01C36AC826957A700D73B3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.dll

Path C:\Program Files (x86)\GearUP\9275\skin.dll
Size 13.8MB
SHA256 2b8751e59e7fc425b20467987fe20e45d5522b91fd7e186f38bd6858277e65c9
MD5 50af8958f1c13cebe76866f51a257a4c
SHA1 a940212513d2647964d91f7053db187fba93fd62
SHA512 21b07688d91c6cb7378b645b3bc7125c2492d4d9c2c2a06faa828377e00ce95e9e5aeeb93d88066e5caab6f725c823fbcd28e38f7d249189de5831b71eefd2e2
SSDEEP 393216:cpJJMddh34030xLuyBj6uIMxhfhdmB61Uwa9j:j30JRxhfzO0Bap
TLSH
T1E5E623D7F3739895C62E4F3931771A90B433F61E8FA2210F7450F6A0A9E2A665B4234D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.dll

Path C:\Program Files (x86)\GearUP\9275\ui.dll
Size 1003KB
SHA256 81f11941b1cc1d3e4e49c76dbed0b5e39d2231f992016a6e599ac17d5d4c40bf
MD5 3ed9ee436c017c877a15bd5b37a40d34
SHA1 dfecd4040d25a18f10031759499915dd43ba1eb6
SHA512 42911e571075429784d4723f63abe8999bf669d49c39345f314e57baeb064357d3ec3362793cee04391fee90bbaf0451271e12dc44613f6e92d873689fd931e6
SSDEEP 24576:n5FjsboH3M4YlmXpmvSfaE8RvOnWGunRLphn7:5tEw0EXpmvSfaE8RvOnWGupL7
TLSH
T181259D61798580B5EB57C3B1CF3C6E3869BDA6610B79C2C773C85A1A09D29D187333A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files (x86)\GearUP\9275\uninstall.exe
Size 2.8MB
SHA256 de2ad6e76335883d0426ec8353030d68915c1b82ede43f90d9be050cf9661b3d
MD5 e68e241a031d06d444d29f60f0aec2b9
SHA1 c61980e183cab5396e515395d1c6412e5b5c6ece
SHA512 05e0073e825fd878a667ee15dc9f6c46145dc472557817733e1d09cd7e4cd67963a1e43b98bdfb907516f2c629a778009b4a530994ff8a251843abccbb601448
SSDEEP 49152:V4cdnpjyrpmRu/ZhWUXk6FHSdLTc1A5A2NSJhGd8UUSPCUUnb258uw4rKI:hdnpjyrpmRu/ZhWUU6Fx1QtNSJh6xUJI
TLSH
T1E2D5CF02FB428072E1970674557EA77AC93ABE305730D5D3A7953D6988302D2AA3F39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Program Files (x86)\GearUP\9275\update.exe
Size 3.2MB
SHA256 363536fd3979861e5f28991d89597774ff12cf2822371a554d665619a4fd5368
MD5 ed2964b8bbd6b405fe8681d2e4ee8b46
SHA1 60a66c05c817d478de2c1e117968485e51f17ca0
SHA512 c2c98fb3e5dc0e15319b0401dc571ffe15d2bbf9c1b36a14325611656ceee92f4aec962124c35ac4d90cf678cd9d9a98239bd0cb53bb87b367d63521bf2d5bf6
SSDEEP 98304:98bXqd+5Vklli1D4XbA5uNlG0Wue2aGF4u:2bXqd+5V8owlGF2aGeu
TLSH
T1B2F5CF12FF438072E19F02755D6E97BAC93AAE30573085C3979F396548305D2AE3E36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\GearUP\9275\vcruntime140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\GearUP\9275\zlib1.dll
Size 77KB
SHA256 b9cbdf114c7c403d844550c12d7dd8c755cd58b5b4f99135d812bafd444364ac
MD5 e3523734f05af14a7b74bc026e3d31b1
SHA1 bc54a7b2adde2004903840ed8279e8b975c67fc2
SHA512 1c81bf56978e86299fa21573e6a6cfe942b7289ecb8e7ee4b1a67af3639d1b45d4274f00f35a0cff4d0e75da420e9fce4183ef439ff9cc62914f3df563a27104
SSDEEP 1536:z77FCOWzicqQPFwYZEABJx98se//002UldXfyIOsIOpcKjKr:TFlWWQuaEsJ0JbXfQipcKj
TLSH
T113739D41AB9143F5D4F5017681F7472DD63630208B87ECEBE28DB6E988127D1AB362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
Size 589KB
SHA256 0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035
MD5 c6d72642721e84d227defc3ec4ab12e6
SHA1 3709a7c3cc795a0012adc6ccaf82a93628703518
SHA512 fa2c8b9fa34b190be45fc363f4760603cb6a389bc01fd617a1861ac709eef5e5dd42ea3d5524a1660ea8202dc17687265cd9bb87f5b4c9a9cf714744a8489389
SSDEEP 12288:qwW5Af1q9Wq0/rxaxQhlS/a4zdFGDyV+LrnYkdcmE1GN6:qwWO+BElQa4xFGe2rnYkdcb1
TLSH
T1FBD48E133AF5C0BED6620530CA1E6BF5A0FA97680B2248C767D08E1D1B798D5C636E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gearup_booster.zip

Path C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip
Size 27.7MB
SHA256 761c3ef2285e10fa2b3409d085d05db14a209a6e4f100195d9cf4e7e442291ed
MD5 d374ad59b7f5036bfc89325f56a2fae3
SHA1 e72a85bda0ff610a6670bf60a4a9fd27f8ce21f1
SHA512 cdfd0c8589ca039bc35ed4426ccf1c13bbd20502c7327f3fb7bda17040901aaf6c97362cfd1a42592cf2bd7e8820e55090d127d28f55d3d5593b9dace57131aa
SSDEEP 786432:lP2WeR1INMe8l1++1Uo2ZOoYfBtdm0H1gUb8EB:KXM2l1+b/sBtdVOUb8g
TLSH
T13C57337E6A8E0F58484D117D23F45EDB61EA0FD1668FED0BA742F150B876CCBAB01642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files (x86)\GearUP\launcher.exe
Size 1.5MB
SHA256 f01adbd974ebd31035023f2d363c3bd01c5533b3747f9c4780a4c7ee13228bec
MD5 0783f52c026ba0deba9afa82dc10891b
SHA1 accb19fdac14c2e6f6cd899389a2080c440b4016
SHA512 428b0f0680b9b2e61f4b891adfc06b203bec001dd8a5515931c3bf7873a538ed5e4ffd876a66f7caef7bb163399d65d3fa72b2cdbb99de55b24a6c91d9443623
SSDEEP 49152:4nlgm4VXkMURex6elj0atzPSPsQWcL7nLy:4nlgm4VXkMUReYelQaFPPQhm
TLSH
T139759D42FE8385B2D58E05781D6E977ECE366D208735D5C38B9F3C6688216C12E3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GearUP.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP.lnk
Size 1KB
SHA256 2cf0d9813a0da6573d46525c92efa0b724f41178c77a95568fa0b311ac5c4893
MD5 0626be90654cefbf4d0e73f091a3f759
SHA1 4ad36ebce54b72f4131976e6dd4322a23a29c48d
SHA512 caf13e87007c29148d70019bb8e990c1786bc84b1a243d8706b62d9fffc7790e523b6688c577b0fc34290b63e3775ecc48ff7d4faa0a48f04a319c64f0a22611
TLSH
T14E418C044FDA072AE3739932187B2722B4237801F2590B2E41C583C28DB99146958F7E
MD5 SHA1 SHA512 TLSH

Submit Download

gu.log

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
Size 242B
SHA256 7eb392cf2ed71c1a4fbf6e9506a684e573df361b598f0018c0002f550b2eba52
MD5 95baf067925be387c28020d224fd29cc
SHA1 4e497b04f4fc22b67bc80566271272fe8123ef1c
SHA512 d4e2d1f5a20ab218112dbc5009dc2267cea600ea2e67e9cfa5232233e7e28afb730b422cc2b85d90d9051056aeb36656468cce91c6264498106ccdc054eb4ea8
TLSH
T15BD097B8E28870AC0A06213A8924600872910A2D69060EE321290D1A57380E32344D2E
MD5 SHA1 SHA512 TLSH

Submit Download

04a183eb-dc91-425b-94f1-2665910e2b3c.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\04a183eb-dc91-425b-94f1-2665910e2b3c.tmp
Size 16KB
SHA256 a46a82594a08366ae37bb29f77847a52b914e617a51ae6de84cbebfa67a7a896
MD5 88b40020b9932f422041f40ee49a2c23
SHA1 89e82fa1c97389fee01d81aa7de1b5897f830921
SHA512 7d2c876e4bc45bd88ccf332c514a8e0be38888779d802ed167e6672a1ae20d16feaa8ba9dc2d162e0d4d7bfcb692e4647105817fd4393fef2fbeccb275d29275
SSDEEP 384:0+OBqImmJvGBLx3NaFMJFNNBS2hAIuJvw5g6r/:FcvGtlNGptwbT
TLSH
T1EF729D7A6C629B333CFBC689BA8A7787CB64625385C46BC4CCDC6F0E515B49D0352815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

575f9c4f-25c8-4746-ad90-950cb15ba60d.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\575f9c4f-25c8-4746-ad90-950cb15ba60d.tmp
Size 3KB
SHA256 cc8d67f79c99e64fe95edc69fdf73ac46e16d7358b60db46ae7efadbfc8142bc
MD5 0604a6c8475afd4155180337152236d7
SHA1 d4a786b9387b10c6e8093066a71a358056c63a25
SHA512 9e9cba54019de1e955fab48e041240ad9c103aa2adfc659a2159be5735fdc257b327f3b2ae6987cd5b36123db2447c6f5a87aa4f754bceb992a2f7b0038d5e7a
TLSH
T1056197776974DA375EE7DA05B8863B06FB656023D9823F54D6EC0F1C01DB2981342C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 53e6a34fb3566ea10233bafaaabb33ce43784e097bbd3366682e76587c6f4b09
MD5 929074d2fa9086f9faf8370ef99a543c
SHA1 33674b049e5464b9e01c33b78a565a970ea37347
SHA512 52971d36b4a2847b1e047f9070ed5750e1967b8b7e92e3f2ceab8bea392d529df435c50543ed3e0bac5c035c721917190ad999c42dc2f90e893e451f1a611aba
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b2a268e8989c89c579573a8b5968885e9cd52cfe285b8a34b6be75f6bb0b036c
MD5 8ce2a437aa4c0d310c710c417e5432d3
SHA1 e49f6bb447df9298db17ad9b4ed5dc452ecddcaf
SHA512 fa1525aee67b05215a7a6e4dd1fd7204a1e62f09158fb33bcf42b904be3d85847f4802897b802b6c33c93e5bd0e7be814efee70dd473866112f57c97de9915e2
TLSH
T14CD0121273120675D01020770202B1480800C60B41066100543D8A6F6F844584D02491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

15e4bbeb-b63b-45ad-93cd-269edd959ed1.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\15e4bbeb-b63b-45ad-93cd-269edd959ed1.tmp
Size 5KB
SHA256 ffbaa1bae2cf00dab69d9224d5c6ef84d10b651f1ad7d4e86e2bd70ca2ce3e99
MD5 9d03a52172101c44f509b55b27a93412
SHA1 56ee9edc96a76502abf1f1a20b7de806ccaa9d7e
SHA512 9aa00810a88ce6f9c24c2197dde898fa17de128e1dd11011d5acef9e8de6654dcb242769f08fe72c96bd08962d2165799d9d4a734d6048236d4e5f4636d6d404
SSDEEP 96:stH/dKEkGjpb9Xklo5h16ZZs7/x+6MhmuecmjebK+gx28XM2C7K:stfwkbco+sV+FijNPGDK
TLSH
T195C187015E24797B8CC7E519BA297B03D2F9607261D51E58EBFC461C08DB5DC531790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

505bd987-4ae7-4296-a23a-7cc9a6b14871.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\505bd987-4ae7-4296-a23a-7cc9a6b14871.tmp
Size 5KB
SHA256 e4f2f176de98b70fb3859ddb806e0b262c7e754047c763bfae06a821b1ec4e98
MD5 07a21a181965c0182e24ff7cf9536a4b
SHA1 d2b153e14de3486aebf22992f894640082b6cfb1
SHA512 c43b0196b40567ecff8e198f170236dc037ee535d28bf87603ebcb9c39376b27a1ae62e45366b8ff17e674f4ac0ed1f7f121a54bf370c94a0b9464c44bedf452
SSDEEP 96:stH/dKENjpb9Xklo5h16ZZs7/x+6MhmuecmjebK+gx28XM2C7K:stfwGbco+sV+FijNPGDK
TLSH
T12EC196015E28697B4CC7E619BA397B03E2F9607235D51E58EBFC462C08DB5DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e993e21-104b-4630-a463-037eddefa968.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\5e993e21-104b-4630-a463-037eddefa968.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c3075ea7-686f-4eab-ba5c-fac2dc74aa67.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\c3075ea7-686f-4eab-ba5c-fac2dc74aa67.tmp
Size 5KB
SHA256 b445c9bc3cdf3ef21c3f3ebbc59e6f6362f5fa6353e2461f423f0e678a43c650
MD5 113c69a22b2b26c7dbfa91e27da8cf3e
SHA1 1c2c6ef4b46c15f3d1dff6de33a532431bb083c2
SHA512 0c2ccfe3ab9d948cc3eaf8feed2a2618f1d8a6e9c8b63e3a41d5d16bcb59cf81d84b35653900785de74849943e56dff3e603293a0d0e1678eea3a6a2b8ae605f
SSDEEP 96:rH/dKENjpb9Xk5do616ZZs7/x+6MhmuecmjebK+gU28XM2C7K:rfwGbQojsV+FijNGGDK
TLSH
T1E3C186025E28A97B4CCAE549BA397B03D2F9A07275D52E58E7F8462C08DB5DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 3KB
SHA256 2ee5c3cac338dd1e9aeba44ac9416297c894faecf40ba2c83553e49ab80b48f6
MD5 00b919b7eb61b65c888f512a0c5785c1
SHA1 1c819fe50cb573dce33932421c755bf86df28e0f
SHA512 0775d7cb5b1c3bba68f33b92c66019a19247fa8f1132e646c87df218b9fb7d8eefbbe4402163165e309f17e5ef8a7d641edd19c9c2fefb82b832a9cd5cf86118
TLSH
T1DE7196276974AA375EF7D905B8463B02BB68A023E9863F94D9EC0F1C41D72C91342823
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
Size 1KB
SHA256 751f13bb5fcb310466405e3bc28f98dc1df17612057e8193c1875861e6259ccb
MD5 310338f2f1143d6f4923d100a0943916
SHA1 d921728cb4dd5c9a3f8996b8808300668220820b
SHA512 fb6e77e09981188bb132bec05f85bf59ee3531881e2bd295d491ad9090dd9e39fa80a916f61c10cdcfcaa870ce4b4d97fe7d8a1de4fdd86e31c29244cd49e2f2
TLSH
T1A02192B3F9A04B32FDDAA65A30067B0BFF34706781124F00E2CD072C22DA48D596A833
MD5 SHA1 SHA512 TLSH

Submit Download

fd5dd3f0-5e6e-4ddf-a211-83b91f37924b.tmp

Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\fd5dd3f0-5e6e-4ddf-a211-83b91f37924b.tmp
Size 2KB
SHA256 3ced3d78302a3563f2004c6bcff0ac19e95e9a9376373d84682386a79e84ed2a
MD5 e0109b57147d340aaee383014f454232
SHA1 e07248aae98c32006cc3de0517a917a91908a38f
SHA512 f184eb75997fe66c08f2306e540ae505e3e9dcebc979e3e1b74ae26186f432ec310e1272c9ae0dc722c11a4dbfde74e33850bd270695a9f2862273f71b87b954
TLSH
T18851757378149B379EE68A5978463B13DF39B0A39A532F10DADC071C41DA55D1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_1789501345\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2804_585582747\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

memory/884-428-0x00007FFD6E4B0000-0x00007FFD6E4B1000-memory.dmp

Download

memory/2528-669-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-659-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-661-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-666-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-668-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-665-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-670-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/2528-667-0x0000018EE9250000-0x0000018EE9251000-memory.dmp

Download

memory/3760-575-0x00007FFD6DE00000-0x00007FFD6DE01000-memory.dmp

Download

memory/3760-574-0x00007FFD6D620000-0x00007FFD6D621000-memory.dmp

Download

memory/5760-0-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/5908-390-0x00007FFD6E4B0000-0x00007FFD6E4B1000-memory.dmp

Download