General

Malware Config

Signatures

Files

• ggpermV3.zip

  .zip
• ggpermV3/AMIDEWINx64.EXE

  .exe windows:6 windows x64 arch:x64

  ed928bd060b03bab412d37a11b9d26a0

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  ReadConsoleInputA

  SetConsoleMode

  GetCommandLineA

  QueryPerformanceCounter

  GetCurrentProcessId

  GetFullPathNameA

  CloseHandle

  Sleep

  GetCurrentProcess

  GetSystemDirectoryA

  GetWindowsDirectoryA

  CreateFileA

  DeviceIoControl

  GetModuleFileNameA

  GetModuleHandleA

  GetCurrentDirectoryA

  DeleteFileA

  GetLastError

  CreateMutexA

  SetThreadExecutionState

  SetConsoleCtrlHandler

  ReadFile

  WriteFile

  CreateNamedPipeA

  CreateThread

  LocalFree

  EncodePointer

  DecodePointer

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  ExitProcess

  GetModuleHandleExW

  AreFileApisANSI

  MultiByteToWideChar

  WideCharToMultiByte

  HeapFree

  RtlLookupFunctionEntry

  RtlUnwindEx

  HeapAlloc

  RtlPcToFileHeader

  RaiseException

  GetEnvironmentStringsW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  GetCurrentThreadId

  DeleteCriticalSection

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetStdHandle

  GetFileType

  GetStartupInfoW

  RtlCaptureContext

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  InitializeCriticalSectionAndSpinCount

  TerminateProcess

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleW

  GetModuleFileNameW

  LoadLibraryExW

  GetProcessHeap

  ReadConsoleW

  SetFilePointerEx

  HeapReAlloc

  GetStringTypeW

  CompareStringW

  LCMapStringW

  SetStdHandle

  WriteConsoleW

  OutputDebugStringW

  CreateFileW

  SetEnvironmentVariableA

  SetEndOfFile

  GetVersionExA

  LoadLibraryA

  GetProcAddress

  HeapSize

  FreeLibrary

  FreeEnvironmentStringsW

  shell32

  ShellExecuteA

  user32

  DefWindowProcA

  DispatchMessageA

  TranslateMessage

  GetMessageA

  RegisterClassExA

  MessageBoxA

  BlockInput

  SystemParametersInfoA

  ExitWindowsEx

  CreateWindowExA

  wsprintfA

  advapi32

  ControlService

  RegOpenKeyExA

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  OpenProcessToken

  CloseServiceHandle

  CreateServiceA

  DeleteService

  OpenSCManagerA

  OpenServiceA

  StartServiceA

  Sections

  .text

  Size: 240KB - Virtual size: 239KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 114KB - Virtual size: 114KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 78KB - Virtual size: 116KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ggpermV3/Final_Cleaner.bat
• ggpermV3/Newtonsoft.Json.dll

  .dll windows:4 windows x86 arch:x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Code Sign

  06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

  Certificate

  Issuer

  CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

  Not Before

  15-01-2021 00:00

  Not After

  14-01-2046 23:59

  Subject

  CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

  Certificate

  Issuer

  CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

  Not Before

  15-07-2021 00:00

  Not After

  14-07-2031 23:59

  Subject

  CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

  Certificate

  Issuer

  CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

  Not Before

  13-08-2021 00:00

  Not After

  29-10-2024 23:59

  Subject

  SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

  Signer

  Actual PE Digest

  38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 681KB - Virtual size: 680KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ggpermV3/Siticone.UI.dll

  .dll windows:4 windows x86 arch:x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Code Sign

  3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:ae

  Certificate

  Issuer

  CN=Siticone Root CA

  Not Before

  05-02-2020 06:42

  Not After

  22-10-2030 17:00

  Subject

  CN=Siticone Technology

  03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

  Certificate

  Issuer

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2014 00:00

  Not After

  22-10-2024 00:00

  Subject

  CN=DigiCert Timestamp Responder,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2021 00:00

  Subject

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageEmailProtection

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0

  Signer

  Actual PE Digest

  34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• ggpermV3/Trinity Cleaner.exe

  .exe windows:6 windows x64 arch:x64

  9e28a931454d510c8c68ce218a71016a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  Beep

  RtlLookupFunctionEntry

  GetModuleHandleW

  Sleep

  GetStdHandle

  SetConsoleTitleA

  SetConsoleTextAttribute

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  DeleteFileW

  IsDebuggerPresent

  RtlCaptureContext

  user32

  MessageBoxA

  advapi32

  RegOpenKeyExA

  GetUserNameW

  RegQueryValueExA

  RegSetValueExA

  msvcp140

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?uncaught_exception@std@@YA_NXZ

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  memcpy

  memmove

  memset

  __std_exception_destroy

  __std_exception_copy

  __std_terminate

  __C_specific_handler

  _CxxThrowException

  __current_exception_context

  __current_exception

  api-ms-win-crt-runtime-l1-1-0

  _exit

  _invalid_parameter_noinfo_noreturn

  _initterm_e

  _initterm

  _c_exit

  _crt_atexit

  terminate

  system

  __p___argv

  _cexit

  _register_thread_local_exe_atexit_callback

  _seh_filter_exe

  _set_app_type

  __p___argc

  _register_onexit_function

  _initialize_onexit_table

  exit

  _get_initial_narrow_environment

  _initialize_narrow_environment

  _configure_narrow_argv

  api-ms-win-crt-heap-l1-1-0

  _callnewh

  malloc

  free

  _set_new_mode

  api-ms-win-crt-utility-l1-1-0

  rand

  api-ms-win-crt-stdio-l1-1-0

  __acrt_iob_func

  __p__commode

  _set_fmode

  __stdio_common_vfprintf

  __stdio_common_vsprintf

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 729KB - Virtual size: 729KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 92B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ggpermV3/amifldrv64.sys

  .sys windows:6 windows x64 arch:x64

  363922cc73591e60f2af113182414230

  
  

  Code Sign

  61:20:4d:b4:00:00:00:00:00:27

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:45

  Not After

  15-04-2021 19:55

  Subject

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  24-06-2014 00:00

  Not After

  30-08-2017 12:00

  Subject

  SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

  Certificate

  Issuer

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2014 00:00

  Not After

  22-10-2024 00:00

  Subject

  CN=DigiCert Timestamp Responder,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2021 00:00

  Subject

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageEmailProtection

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe

  Signer

  Actual PE Digest

  6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  ntoskrnl.exe

  ZwMapViewOfSection

  RtlInitUnicodeString

  ZwUnmapViewOfSection

  ZwClose

  ObReferenceObjectByHandle

  ZwOpenSection

  MmUnmapLockedPages

  MmMapLockedPages

  MmFreeContiguousMemory

  MmBuildMdlForNonPagedPool

  IoFreeMdl

  MmGetPhysicalAddress

  MmMapIoSpace

  PsGetVersion

  MmIsAddressValid

  IoAllocateMdl

  MmAllocateContiguousMemory

  DbgPrint

  IoDeleteSymbolicLink

  IoDeleteDevice

  IofCompleteRequest

  IoCreateSymbolicLink

  IoCreateDevice

  KeBugCheckEx

  MmMapLockedPagesSpecifyCache

  MmUnmapIoSpace

  hal

  HalTranslateBusAddress

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 572B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 272B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  INIT

  Size: 1024B - Virtual size: 1010B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• ggpermV3/ggpermV3.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 60KB - Virtual size: 59KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ggpermV3/macchanger.bat
• ggpermV3/sxghr-driver.dll

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ggpermV3/sxghr-driver.exe

  .exe windows:6 windows x64 arch:x64

  5c16479801aac25e19e4d3e71f54842d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  FreeLibrary

  LoadLibraryExW

  OutputDebugStringW

  FindFirstFileExW

  EnterCriticalSection

  GetFullPathNameW

  FindNextFileW

  GetCurrentProcess

  GetModuleHandleExW

  GetModuleFileNameW

  LeaveCriticalSection

  GetEnvironmentVariableW

  GetModuleHandleW

  MultiByteToWideChar

  GetFileAttributesExW

  LoadLibraryA

  DeleteCriticalSection

  WideCharToMultiByte

  IsWow64Process

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  GetProcAddress

  GetWindowsDirectoryW

  FindResourceW

  GetLastError

  ActivateActCtx

  FindClose

  CreateActCtxW

  SetLastError

  RaiseException

  RtlPcToFileHeader

  RtlUnwindEx

  InitializeSListHead

  GetCurrentProcessId

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  GetStringTypeW

  SwitchToThread

  GetCurrentThreadId

  InitializeCriticalSectionEx

  EncodePointer

  DecodePointer

  LCMapStringEx

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  user32

  MessageBoxW

  shell32

  ShellExecuteW

  advapi32

  RegOpenKeyExW

  RegGetValueW

  DeregisterEventSource

  RegisterEventSourceW

  ReportEventW

  RegCloseKey

  api-ms-win-crt-runtime-l1-1-0

  _invalid_parameter_noinfo_noreturn

  _initialize_onexit_table

  _crt_atexit

  _cexit

  _seh_filter_exe

  _set_app_type

  _exit

  __p___argc

  __p___wargv

  _c_exit

  _errno

  _register_thread_local_exe_atexit_callback

  exit

  _configure_wide_argv

  abort

  _initterm_e

  _initterm

  _initialize_wide_environment

  _get_initial_wide_environment

  terminate

  _register_onexit_function

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  setvbuf

  __stdio_common_vswprintf

  _set_fmode

  __stdio_common_vfwprintf

  fflush

  __stdio_common_vsnwprintf_s

  _wfsopen

  fputws

  fputwc

  __acrt_iob_func

  api-ms-win-crt-heap-l1-1-0

  free

  _set_new_mode

  malloc

  calloc

  _callnewh

  api-ms-win-crt-string-l1-1-0

  strcpy_s

  wcsncmp

  toupper

  wcsnlen

  _wcsdup

  api-ms-win-crt-convert-l1-1-0

  wcstoul

  _wtoi

  api-ms-win-crt-time-l1-1-0

  _gmtime64_s

  wcsftime

  _time64

  api-ms-win-crt-locale-l1-1-0

  ___mb_cur_max_func

  ___lc_codepage_func

  ___lc_locale_name_func

  _configthreadlocale

  setlocale

  _unlock_locales

  _lock_locales

  __pctype_func

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  Sections

  .text

  Size: 88KB - Virtual size: 88KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 37KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 792B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• ggpermV3/sxghr-driver.pdb
• ggpermV3/sxghr-driver.runtimeconfig.json
• ggpermV3/woof.bat