MVP Slotted[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MVP Slotted.exe
Size 10.0MB
Sample261003-16d68ayaka
SHA256 b534d65e80c0c43428ce783e117bda529766e022388be5c29aeed6e865123a0a
MD5 6f489dc5199f23810bd5478acc179219
SHA1 3955874d9ac814e2a5da01d2282ea7cd5ad8326e
SHA512 bb1e79127e5a4ba33687e560bc4d7d331647b74c416e39f2a52483e66fc2a1c281a8b8af1800ee34ebfab36c3c5c8e0d5df918888f6a58c6a64052f1d590b1cb
SSDEEP 196608:AT9K1UUrCJb3VisFkkjoO6ZAGBltrhmvPT7:AMUUrk7MkjwmvP
TLSH
T150B69EE55B8F76D1E03B0D3887F0A500661B67F6B71546CBED9C85CA3D312E24F8928A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MVP Slotted.exe

File Explorer

MVP Slotted.exe

.exe 10.0MB

MVP Slotted.exe

IMPHASH 9cf3d177057d5808366a0af244f112be
SHA256 b534d65e80c0c43428ce783e117bda529766e022388be5c29aeed6e865123a0a
MD5 6f489dc5199f23810bd5478acc179219
SHA1 3955874d9ac814e2a5da01d2282ea7cd5ad8326e
SHA512 bb1e79127e5a4ba33687e560bc4d7d331647b74c416e39f2a52483e66fc2a1c281a8b8af1800ee34ebfab36c3c5c8e0d5df918888f6a58c6a64052f1d590b1cb
SSDEEP 196608:AT9K1UUrCJb3VisFkkjoO6ZAGBltrhmvPT7:AMUUrk7MkjwmvP
TLSH
T150B69EE55B8F76D1E03B0D3887F0A500661B67F6B71546CBED9C85CA3D312E24F8928A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9437244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW Sleep GetLastError GetFileAttributesA Process32NextW QueryFullProcessImageNameA QueryPerformanceFrequency Process32FirstW K32GetModuleBaseNameA CreateThread LocalFree QueryPerformanceCounter VerSetConditionMask FreeLibrary SetLastError TerminateProcess CreateMutexW SetUnhandledExceptionFilter ReadFile SetInformationJobObject FindFirstFileW SetHandleInformation FindNextFileW GetStdHandle AssignProcessToJobObject RemoveDirectoryW SetFileTime WaitForMultipleObjects CreateJobObjectW CreatePipe GetFileAttributesW SetFileAttributesW CreateEventW SetEvent DeleteFileW ResetEvent GetCurrentThread ReadDirectoryChangesW TryAcquireSRWLockExclusive CopyFileW GetFileTime GetStartupInfoW GetCommandLineW WriteFile AcquireSRWLockExclusive FormatMessageA PeekNamedPipe GetFileType CreateRemoteThread MoveFileExA VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc CreateFileA SetFileInformationByHandle CreateFile2 AreFileApisANSI FlushInstructionCache GetCurrentProcessId MoveFileExW SetThreadPriority VirtualQueryEx GlobalUnlock GetOverlappedResult QueryFullProcessImageNameW GetFileInformationByHandleEx GetCurrentProcess FindFirstFileA WriteProcessMemory InitOnceExecuteOnce GetFileSizeEx GetModuleFileNameA CreateDirectoryW InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead ExitProcess GetExitCodeProcess ReadProcessMemory VirtualProtectEx CloseHandle CreateToolhelp32Snapshot OpenProcess Module32First GlobalLock GetProcAddress GetLocalTime GlobalFree GlobalAlloc DeleteFileA LoadLibraryA ReleaseSRWLockExclusive MultiByteToWideChar GetSystemWindowsDirectoryA GetModuleHandleA DuplicateHandle GetCurrentThreadId CreateFileW WaitForSingleObject FindClose GetTempPathW GetEnvironmentVariableW Module32Next VirtualFreeEx VirtualAllocEx GetTickCount GetTickCount64 GetEnvironmentVariableA SleepConditionVariableSRW FindNextFileA GetProcessId GetModuleFileNameW WaitForSingleObjectEx OutputDebugStringA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW CreateProcessW

user32

RegisterClassExW SetProcessDpiAwarenessContext GetKeyState TrackMouseEvent SetCapture SetCursor SetProcessDPIAware FindWindowA PostThreadMessageW GetWindowLongPtrA GetWindowDisplayAffinity SetClipboardData GetMonitorInfoA SetWindowDisplayAffinity EmptyClipboard CloseClipboard OpenClipboard ShowWindow EnumDisplayMonitors MessageBoxW GetWindowRect PostMessageW EndPaint BeginPaint GetCursorPos SendInput GetAncestor InvalidateRect ShowCursor SetForegroundWindow ReleaseCapture UpdateWindow RegisterClassExA SetWindowLongPtrA GetCapture DispatchMessageW GetCursorInfo GetMonitorInfoW ClientToScreen GetWindowThreadProcessId IsWindow GetAsyncKeyState SetCursorPos GetClipboardData GetMessageW GetLastActivePopup DefWindowProcW AllowSetForegroundWindow DispatchMessageA LoadCursorA DestroyWindow IsWindowVisible SetWindowPos MonitorFromWindow SetActiveWindow SetWindowLongPtrW GetLayeredWindowAttributes PeekMessageW GetForegroundWindow IsIconic GetWindowTextA MsgWaitForMultipleObjectsEx RegisterClassW GetClipCursor AttachThreadInput IsWindowEnabled UnhookWindowsHookEx GetClassNameA UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW PostQuitMessage PeekMessageA GetClientRect ClipCursor FindWindowW TranslateMessage SetFocus SetLayeredWindowAttributes CreateWindowExA DefWindowProcA EnumWindows FillRect GetWindowLongPtrW

gdi32

GetStockObject

advapi32

CredReadA RegSetValueExA RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges OpenProcessToken GetTokenInformation CredWriteA CredFree RegCreateKeyExA RegGetValueA RegCloseKey CredDeleteW LookupPrivilegeValueA CredReadW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CredWriteW DuplicateTokenEx CreateProcessAsUserW SetThreadToken SetTokenInformation PrivilegeCheck RevertToSelf LookupPrivilegeValueW

shell32

ShellExecuteA SHGetKnownFolderPath SHGetFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitializeEx PropVariantClear CoTaskMemFree

msvcp140

?id@?$collate@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z __crtLCMapStringW __crtLCMapStringA _Strxfrm ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?is@?$ctype@_W@std@@QEBA_NF_W@Z _Query_perf_frequency _Lock_shared_ptr_spin_lock ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ _Unlock_shared_ptr_spin_lock ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock _Cnd_broadcast _Thrd_yield ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Mtx_trylock _Cnd_signal _Wcscoll ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Wcsxfrm _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_detach _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z

ws2_32

ntohl select WSAIoctl getsockopt WSAStartup htons ioctlsocket gethostname sendto recvfrom freeaddrinfo inet_addr accept WSASetLastError htonl socket ntohs connect setsockopt getsockname getpeername bind send recv WSAGetLastError getaddrinfo closesocket listen WSACleanup __WSAFDIsSet

normaliz

IdnToAscii

crypt32

CryptDecodeObjectEx CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFreeCertificateChain CryptUnprotectData CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptQueryObject CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CertGetCertificateChain

wldap32

ord46 ord217 ord143 ord60 ord45 ord50 ord301 ord200 ord211 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

dwmapi

DwmRegisterThumbnail DwmUpdateThumbnailProperties DwmFlush DwmSetWindowAttribute DwmGetCompositionTimingInfo DwmUnregisterThumbnail DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod timeEndPeriod

winhttp

WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpOpenRequest WinHttpSetOption WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSendRequest WinHttpWebSocketShutdown WinHttpSetTimeouts WinHttpConnect WinHttpWebSocketCompleteUpgrade WinHttpWebSocketSend WinHttpWebSocketReceive WinHttpReadData

bcrypt

BCryptGenRandom BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash

shlwapi

PathFindFileNameW

mfplat

MFStartup MFCreateAttributes MFCreateMediaType MFShutdown

mfreadwrite

MFCreateSourceReaderFromURL

dxgi

CreateDXGIFactory1 CreateDXGIFactory

imm32

ImmAssociateContextEx ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __C_specific_handler __std_type_info_compare strchr __RTtypeid strstr strrchr longjmp __std_exception_copy memmove memset memchr memcmp __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException memcpy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc realloc _set_new_mode free _callnewh calloc

api-ms-win-crt-math-l1-1-0

llround sqrt sqrtf roundf powf sinf sin lround remainderf pow cosf floor ceilf atan2f lroundf asinf acosf fmodf log _hypotf __setusermatherr logf _dsign expf floorf

api-ms-win-crt-runtime-l1-1-0

terminate strerror _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _exit _getpid exit _errno __sys_nerr _initterm_e abort _initterm _get_narrow_winmain_command_line _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit set_terminate _set_app_type

api-ms-win-crt-string-l1-1-0

isxdigit isprint strnlen _wcsicmp _strdup isalpha isupper _wcsnicmp strncpy strcmp wcslen towlower strncmp _stricmp strspn isdigit strcspn isalnum toupper tolower isspace strpbrk strlen iscntrl

api-ms-win-crt-stdio-l1-1-0

fclose fflush fputc __stdio_common_vsprintf fopen _set_fmode _lseeki64 fputs __stdio_common_vsprintf_s __stdio_common_vfwprintf __p__commode fgetc _wfopen_s __stdio_common_vsnprintf_s _read _write _close _open __stdio_common_vswprintf_s fgets __stdio_common_vswprintf feof __stdio_common_vsnwprintf_s __stdio_common_vsscanf _wfopen fseek __acrt_iob_func fwrite _get_stream_buffer_pointers _fseeki64 fread fsetpos fgetpos ungetc setvbuf ftell

api-ms-win-crt-convert-l1-1-0

strtoul strtod atoi _wtoi64 strtol atof mbstowcs strtoull strtoll

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _access remove _unlock_file _unlink _stat64

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func localeconv _configthreadlocale ___lc_collate_cp_func ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

378KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

408KB

Virtual Size

408KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.obf1

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nexapi

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.obf3

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

MVP Slotted.exe

d3dx9_43

d3dx11_43

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

ws2_32

normaliz

crypt32

wldap32

ntdll

dwmapi

winmm

winhttp

bcrypt

shlwapi

mfplat

mfreadwrite

dxgi

imm32

d3dcompiler_43

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic