NEAS[.]c110d020197b865aabe591fcb3baf7e0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.c110d020197b865aabe591fcb3baf7e0.exe
Size

460KB
MD5

c110d020197b865aabe591fcb3baf7e0
SHA1

fbba6e9ac659f440116ab8990b8bd51e2947de3d
SHA256

def0bd12ecfe7950abda8cae39e72f95d4971743db3bbf88141704bb17639a7a
SHA512

c05298e9f52012fdbde2213f084777b2ffd2b2ad295b7744a0a891e2f04301385b0dae7f461baca78a4743e26c39ea85d2613717b4dde5f84393c4e3aa22068f
SSDEEP

12288:uvPtz8rpwk/ELUqz1im7ck3q3vOf9kKf3E:uvPtQpwk8LUqz1im7ck3q3vOf9kKP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c110d020197b865aabe591fcb3baf7e0.exe

Files

NEAS.c110d020197b865aabe591fcb3baf7e0.exe
.dll windows:6 windows x64

26b88e29700dd4c6c136fae8d575b140

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shadercompileworker-core

??4FString@@QEAAAEAV0@PEB_W@Z
?AssignRange@FString@@AEAAXPEB_WH@Z
?Empty@FString@@QEAAXXZ
?Reset@FString@@QEAAXH@Z
?AppendChars@FString@@QEAAXPEB_WH@Z
?AppendChar@FString@@QEAAAEAV1@_W@Z
?RemoveAt@FString@@QEAAXHH_N@Z
?PathAppend@FString@@QEAAXPEB_WH@Z
?ConcatFF@FString@@CA?AV1@AEBV1@$$QEAV1@@Z
?IsNumeric@FString@@QEBA_NXZ
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?StartsWith@FString@@QEBA_NPEB_WHW4Type@ESearchCase@@@Z
?EndsWith@FString@@QEBA_NPEB_WHW4Type@ESearchCase@@@Z
?ParseIntoArray@FString@@QEBAHAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@PEB_W_N@Z
?Reserve@FString@@QEAAXH@Z
?ToBool@FString@@QEBA_NXZ
?SanitizeFloat@FString@@SA?AV1@NH@Z
?InlineCombineSurrogates@StringConv@@YAXAEAVFString@@@Z
??1?$TStringBuilderBase@D@@QEAA@XZ
?AppendfImpl@?$TStringBuilderBase@D@@CAAEAV1@AEAV1@PEBDZZ
??1?$TStringBuilderBase@_W@@QEAA@XZ
?AppendfImpl@?$TStringBuilderBase@_W@@CAAEAV1@AEAV1@PEB_WZZ
?Extend@?$TStringBuilderBase@_W@@IEAAX_K@Z
?FromValidEName@FNameEntryId@@CA?AU1@W4EName@@@Z
?GetTypeHash@@YAIUFNameEntryId@@@Z
?ToString@FName@@QEBA?AVFString@@XZ
??0FName@@QEAA@PEBDW4EFindName@@@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?Value@FParse@@SA_NPEB_W0AEAVFString@@_NPEAPEB_W@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?BasicFatalLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
??0FScopedBootTiming@@QEAA@PEBD@Z
??1FScopedBootTiming@@QEAA@XZ
??0FEngineTrackedActivityScope@@QEAA@AEBVFString@@@Z
??1FEngineTrackedActivityScope@@QEAA@XZ
?GetCurrentTag@FTaskTagScope@@SA?AW4ETaskTag@@XZ
?IsInActualRenderingThread@@YA_NXZ
?GenerateNewID@FDelegateHandle@@CA_KXZ
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?Get@FThreadSingletonInitializer@@SAPEAVFTlsAutoCleanup@@V?$TFunctionRef@$$A6APEAVFTlsAutoCleanup@@XZ@@AEAI@Z
?GetBinariesSubdirectory@FWindowsPlatformProcess@@SAPEB_WXZ
?LaunchURL@FWindowsPlatformProcess@@SAXPEB_W0PEAVFString@@@Z
??0FEventRef@@QEAA@W4EEventMode@@@Z
??1FEventRef@@QEAA@XZ
?RestoreInheritedContext@FInheritedContextBase@UE@@QEAA?AVFInheritedContextScope@2@XZ
?AnsiMalloc@@YAPEAX_KI@Z
?AnsiFree@@YAXPEAX@Z
?FreeChunks@FMemStackBase@@AEAAXPEAUFTaggedMemory@1@@Z
?GetTlsSlot@?$TThreadSingleton@VFMemStack@@@@CAAEAIXZ
??0FMemStack@@QEAA@XZ
??1FMemStack@@UEAA@XZ
?OnInvalidConcurrentLinearArrayAllocatorNum@Private@Core@UE@@YAXH_K@Z
?GetActiveTask@FTask@LowLevelTasks@@SAPEBV12@XZ
?Get@FTextLocalizationManager@@SAAEAV1@XZ
?HandleLocalizationTargetsMounted@FTextLocalizationManager@@QEAAXV?$TArrayView@$$CBVFString@@H@@@Z
?HandleLocalizationTargetsUnmounted@FTextLocalizationManager@@QEAAXV?$TArrayView@$$CBVFString@@H@@@Z
??0FTextFormat@@QEAA@AEBVFText@@@Z
??0FText@@QEAA@XZ
?FromName@FText@@SA?AV1@AEBVFName@@@Z
?FromString@FText@@SA?AV1@AEBVFString@@@Z
?FromString@FText@@SA?AV1@$$QEAVFString@@@Z
?ToString@FText@@QEBAAEBVFString@@XZ
?IsEmpty@FText@@QEBA_NXZ
?Format@FText@@SA?AV1@VFTextFormat@@$$QEAV?$TArray@VFFormatArgumentValue@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?ForUseOnlyByLocMacroAndGraphNodeTextLiterals_CreateText@FInternationalization@@SA?AVFText@@PEB_W00@Z
?IsWorkerThread@FSchedulerTls@LowLevelTasks@@QEBA_NXZ
?LaunchInternal@FScheduler@LowLevelTasks@@AEAAXAEAVFTask@2@W4EQueuePreference@2@_N@Z
?Get@FTaskGraphInterface@@SAAEAV1@XZ
?Get@FCommandLine@@SAPEB_WXZ
?GetBuildConfiguration@FApp@@SA?AW4EBuildConfiguration@@XZ
?GetBuildTargetType@FApp@@SA?AW4EBuildTargetType@@XZ
?IsUnattended@FApp@@SA_NXZ
?ShouldUseThreadingForPerformance@FApp@@SA_NXZ
?IsForkedMultithreadInstance@FForkProcessHelper@@SA_NXZ
?Get@IFileManager@@SAAEAV1@XZ
??0FSlowTask@@QEAA@MAEBVFText@@_NAEAVFFeedbackContext@@@Z
?Initialize@FSlowTask@@QEAAXXZ
?Destroy@FSlowTask@@QEAAXXZ
?EnterProgressFrame@FSlowTask@@QEAAXMAEBVFText@@@Z
?BeginSlowTask@FFeedbackContext@@QEAAXAEBVFText@@_N1@Z
?EndSlowTask@FFeedbackContext@@QEAAXXZ
?EngineDir@FPaths@@SA?AVFString@@XZ
?EnginePluginsDir@FPaths@@SA?AVFString@@XZ
?ProjectDir@FPaths@@SA?AVFString@@XZ
??0FString@@QEAA@PEB_W@Z
?GameAgnosticSavedDir@FPaths@@SA?AVFString@@XZ
?GetProjectFilePath@FPaths@@SA?AVFString@@XZ
?GetCleanFilename@FPaths@@SA?AVFString@@AEBV2@@Z
?GetBaseFilename@FPaths@@SA?AVFString@@AEBV2@_N@Z
?GetBaseFilename@FPaths@@SA?AVFString@@$$QEAV2@_N@Z
?GetPath@FPaths@@SA?AVFString@@AEBV2@@Z
?IsRelative@FPaths@@SA_NAEBVFString@@@Z
?NormalizeFilename@FPaths@@SAXAEAVFString@@@Z
?IsUnderDirectory@FPaths@@SA_NAEBVFString@@0@Z
?MakeStandardFilename@FPaths@@SAXAEAVFString@@@Z
?MakePlatformFilename@FPaths@@SAXAEAVFString@@@Z
?MakePathRelativeTo@FPaths@@SA_NAEAVFString@@PEB_W@Z
?ConvertRelativePathToFull@FPaths@@SA?AVFString@@AEBV2@@Z
?ConvertRelativePathToFull@FPaths@@SA?AVFString@@$$QEAV2@@Z
?CombineInternal@FPaths@@KA?AVFString@@PEBV?$TStringView@_W@@H@Z
?ExpandValueInternal@FConfigValue@@AEAAXXZ
?FindOrAddSection@FConfigFile@@QEAAPEAVFConfigSection@@AEBVFString@@@Z
?SetArray@FConfigFile@@QEAAXPEB_W0AEBV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?AddDynamicLayerToHierarchy@FConfigFile@@QEAAXAEBVFString@@@Z
?FindConfigFile@FConfigCacheIni@@QEAAPEAVFConfigFile@@AEBVFString@@@Z
?Find@FConfigCacheIni@@QEAAPEAVFConfigFile@@AEBVFString@@@Z
?GetConfigFilename@FConfigCacheIni@@QEAA?AVFString@@PEB_W@Z
?ToString@FEngineVersion@@QEBA?AVFString@@W4EVersionComponent@@@Z
?Parse@FEngineVersion@@SA_NAEBVFString@@AEAV1@@Z
?CompatibleWith@FEngineVersion@@SAAEBV1@XZ
?LoadFileToString@FFileHelper@@SA_NAEAVFString@@PEB_WW4EHashOptions@1@I@Z
?LoadFileToStringArray@FFileHelper@@SA_NAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@PEB_WI@Z
?SaveStringToFile@FFileHelper@@SA_NV?$TStringView@_W@@PEB_WW4EEncodingOptions@1@PEAVIFileManager@@I@Z
?Open@FMessageDialog@@SA?AW4Type@EAppReturnType@@W42EAppMsgType@@AEBVFText@@@Z
?Open@FMessageDialog@@SA?AW4Type@EAppReturnType@@W42EAppMsgType@@AEBVFText@@1@Z
?Get@FModuleManager@@SAAEAV1@XZ
?IsModuleLoaded@FModuleManager@@QEBA_NVFName@@@Z
?LoadModuleWithFailureReason@FModuleManager@@QEAAPEAVIModuleInterface@@VFName@@AEAW4EModuleLoadResult@@W4ELoadModuleFlags@@@Z
?AddBinariesDirectory@FModuleManager@@QEAAXPEB_W_N@Z
?LoadModuleBinaryOnly@FModuleManager@@QEAAXVFName@@@Z
?IsModuleUpToDate@FModuleManager@@QEBA_NVFName@@@Z
?GetPlatformFile@FPlatformFileManager@@QEAAAEAVIPlatformFile@@XZ
?Get@FPlatformFileManager@@SAAEAV1@XZ
?GetAllPlatformInfos@FDataDrivenPlatformInfoRegistry@@SAAEBV?$TMap@VFName@@UFDataDrivenPlatformInfo@@VFDefaultSetAllocator@@U?$TDefaultMapHashableKeyFuncs@VFName@@UFDataDrivenPlatformInfo@@$0A@@@@@XZ
?GetArchiveName@FArchiveState@@UEBA?AVFString@@XZ
?EngineNetVer@FArchiveState@@UEBAIXZ
?GameNetVer@FArchiveState@@UEBAIXZ
?GetCustomVersions@FArchiveState@@UEBAAEBVFCustomVersionContainer@@XZ
?SetCustomVersions@FArchiveState@@UEAAXAEBVFCustomVersionContainer@@@Z
?ResetCustomVersions@FArchiveState@@UEAAXXZ
?SetSerializedPropertyChain@FArchiveState@@UEAAXPEBUFArchiveSerializedPropertyChain@@PEAVFProperty@@@Z
?IsEditorOnlyPropertyOnTheStack@FArchiveState@@UEBA_NXZ
?SetLocalizationNamespace@FArchiveState@@UEAAXAEBVFString@@@Z
?GetLocalizationNamespace@FArchiveState@@UEBA?AVFString@@XZ
?Reset@FArchiveState@@UEAAXXZ
?SetIsLoading@FArchiveState@@UEAAX_N@Z
?SetIsLoadingFromCookedPackage@FArchiveState@@UEAAX_N@Z
?SetIsSaving@FArchiveState@@UEAAX_N@Z
?SetIsTransacting@FArchiveState@@UEAAX_N@Z
?SetIsTextFormat@FArchiveState@@UEAAX_N@Z
?SetWantBinaryPropertySerialization@FArchiveState@@UEAAX_N@Z
?SetUseUnversionedPropertySerialization@FArchiveState@@UEAAX_N@Z
?SetForceUnicode@FArchiveState@@UEAAX_N@Z
?SetIsPersistent@FArchiveState@@UEAAX_N@Z
?SetUEVer@FArchiveState@@UEAAXUFPackageFileVersion@@@Z
?SetLicenseeUEVer@FArchiveState@@UEAAXH@Z
?SetEngineVer@FArchiveState@@UEAAXAEBVFEngineVersionBase@@@Z
?SetEngineNetVer@FArchiveState@@UEAAXI@Z
?SetGameNetVer@FArchiveState@@UEAAXI@Z
??6FArchive@@UEAAAEAV0@AEAUFWeakObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAUFSoftObjectPath@@@Z
??6FArchive@@UEAAAEAV0@AEAUFSoftObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAUFObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAUFLazyObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAVFText@@@Z
?SerializeIntPacked@FArchive@@UEAAXAEAI@Z
?SerializeIntPacked64@FArchive@@UEAAXAEA_K@Z
?UsingCustomVersion@FArchive@@UEAAXAEBUFGuid@@@Z
?PushSerializedProperty@FArchive@@UEAAXPEAVFProperty@@_N@Z
?PopSerializedProperty@FArchive@@UEAAXPEAVFProperty@@_N@Z
?CRCTablesSB8@FCrc@@2PAY0BAA@IA
?CRCTable_DEPRECATED@FCrc@@2PAIA
?LogSerialization@@3UFLogCategoryLogSerialization@@A
?GConfig@@3PEAVFConfigCacheIni@@EA
?GWarn@@3PEAVFFeedbackContext@@EA
?GIsRequestingExit@@3_NA
?GEngineIni@@3VFString@@A
?SecondsPerCycle@FGenericPlatformTime@@1NA
?Singleton@FScheduler@LowLevelTasks@@0V12@A
?RenderThread_Local@FRenderThreadStatics@ENamedThreads@@0V?$TAtomic@W4Type@ENamedThreads@@@@A
?GParallelForBackgroundYieldingTimeoutMs@@3HA
?GatherAdditionalLocResPathsCallback@FCoreDelegates@@2V?$TMulticastDelegate@$$A6AXAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@ZUFDefaultDelegateUserPolicy@@@@A
??0FString@@QEAA@PEBD@Z
?SerializeByteOrderSwapped@FArchive@@AEAAAEAV1@AEAI@Z
??6@YAAEAVFArchive@@AEAV0@AEAVFString@@@Z
??1FArchiveState@@EEAA@XZ
??0FArchiveState@@AEAA@XZ
?GetNewest@FEngineVersionBase@@SA?AW4EVersionComparison@@AEBV1@0PEAW4EVersionComponent@@@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?OnInvalidSetNum@Private@Core@UE@@YAX_K@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?Free@FMemory@@SAXPEAX@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Malloc@FMemory@@SAPEAX_KI@Z
?CheckVerifyImpl@@YA_NAEA_N_NPEBDHPEAX2PEB_WZZ
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?NumberOfCoresIncludingHyperthreads@FWindowsPlatformMisc@@SAHXZ
?GetEnvironmentVariable@FWindowsPlatformMisc@@SA?AVFString@@PEB_W@Z
?GetUBTPlatform@FGenericPlatformMisc@@SAPEB_WXZ
?LexToString@@YAPEB_WW4EBuildTargetType@@@Z
?LexTryParseString@@YA_NAEAW4EBuildTargetType@@PEB_W@Z
?LexToString@@YAPEB_WW4EBuildConfiguration@@@Z
??0FString@@QEAA@HPEB_W@Z
?LexTryParseString@@YA_NAEAW4EBuildConfiguration@@PEB_W@Z
?Memcpy@FGenericPlatformString@@CAPEAXPEAXPEBX_K@Z
?Strnicmp@FGenericPlatformStricmp@@SAHPEB_W0_K@Z
?Stricmp@FGenericPlatformStricmp@@SAHPEB_W0@Z
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
??1FLogCategoryBase@@QEAA@XZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
?ProjectPluginsDir@FPaths@@SA?AVFString@@XZ
??0FName@@QEAA@PEB_WW4EFindName@@@Z

shadercompileworker-json

?AsObject@FJsonValue@@UEBAAEBV?$TSharedPtr@VFJsonObject@@$00@@XZ
?TryGetNumber@FJsonValue@@UEBA_NAEA_K@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAI@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAG@Z
?LogJson@@3UFLogCategoryLogJson@@A
?TryGetNumber@FJsonValue@@UEBA_NAEA_J@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAH@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAF@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAC@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAM@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAE@Z
?AsNumber@FJsonValue@@QEBANXZ
?AsString@FJsonValue@@QEBA?AVFString@@XZ
?AsBool@FJsonValue@@QEBA_NXZ
?AsArray@FJsonValue@@QEBAAEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?SetField@FJsonObject@@QEAAXAEBVFString@@AEBV?$TSharedPtr@VFJsonValue@@$00@@@Z
?RemoveField@FJsonObject@@QEAAXAEBVFString@@@Z
?TryGetNumberField@FJsonObject@@QEBA_NAEBVFString@@AEAH@Z
?TryGetNumberField@FJsonObject@@QEBA_NAEBVFString@@AEAI@Z
?SetNumberField@FJsonObject@@QEAAXAEBVFString@@N@Z
?GetStringField@FJsonObject@@QEBA?AVFString@@AEBV2@@Z
?TryGetStringField@FJsonObject@@QEBA_NAEBVFString@@AEAV2@@Z
?TryGetStringArrayField@FJsonObject@@QEBA_NAEBVFString@@AEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?SetStringField@FJsonObject@@QEAAXAEBVFString@@0@Z
?TryGetBoolField@FJsonObject@@QEBA_NAEBVFString@@AEA_N@Z
?SetBoolField@FJsonObject@@QEAAXAEBVFString@@_N@Z
?GetArrayField@FJsonObject@@QEBAAEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@AEBVFString@@@Z
?TryGetArrayField@FJsonObject@@QEBA_NAEBVFString@@AEAPEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?SetArrayField@FJsonObject@@QEAAXAEBVFString@@AEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?GetObjectField@FJsonObject@@QEBAAEBV?$TSharedPtr@VFJsonObject@@$00@@AEBVFString@@@Z
?TryGetObjectField@FJsonObject@@QEBA_NAEBVFString@@AEAPEBV?$TSharedPtr@VFJsonObject@@$00@@@Z
?SetObjectField@FJsonObject@@QEAAXAEBVFString@@AEBV?$TSharedPtr@VFJsonObject@@$00@@@Z

kernel32

InitializeSListHead
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
QueryPerformanceCounter
GetCurrentThreadId
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
EnterCriticalSection

vcruntime140

__C_specific_handler
memmove
__current_exception
__current_exception_context
__std_type_info_destroy_list
memcpy
_purecall
memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcsncmp
iswspace

api-ms-win-crt-convert-l1-1-0

_wtoi
_wtof
_wtoi64
wcstod
_wcstoui64

api-ms-win-crt-math-l1-1-0

powf
_finite

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_onexit_table
terminate
_initterm_e
_initterm
_cexit
_crt_at_quick_exit
_crt_atexit
_initialize_narrow_environment
_register_onexit_function
_seh_filter_dll
_execute_onexit_table

api-ms-win-crt-heap-l1-1-0

malloc
free

Exports

Exports

??0FLocalizationTargetDescriptor@@QEAA@VFString@@W4Type@ELocalizationTargetDescriptorLoadingPolicy@@@Z
??0FModuleDescriptor@@QEAA@VFName@@W4Type@EHostType@@W42ELoadingPhase@@@Z
??0FPluginDescriptor@@QEAA@XZ
??0FPluginReferenceDescriptor@@QEAA@AEBVFString@@_N@Z
??0FProjectDescriptor@@QEAA@XZ
??_FFLocalizationTargetDescriptor@@QEAAXXZ
??_FFModuleDescriptor@@QEAAXXZ
??_FFPluginReferenceDescriptor@@QEAAXXZ
?AddPluginDirectory@FProjectDescriptor@@QEAA_NAEBVFString@@@Z
?AddRootDirectory@FProjectDescriptor@@QEAA_NAEBVFString@@@Z
?CheckModuleCompatibility@FModuleDescriptor@@SA_NAEBV?$TArray@UFModuleDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@AEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?FindPluginReferenceIndex@FProjectDescriptor@@QEBAHAEBVFString@@@Z
?FromString@EHostType@@YA?AW4Type@1@PEB_W@Z
?FromString@ELoadingPhase@@YA?AW4Type@1@PEB_W@Z
?FromString@ELocalizationTargetDescriptorLoadingPolicy@@YA?AW4Type@1@PEB_W@Z
?FromString@EVerseScope@@YA?AU?$TOptional@W4Type@EVerseScope@@@@PEB_W@Z
?Get@IPluginManager@@SAAEAV1@XZ
?Get@IProjectManager@@SAAEAV1@XZ
?GetExtension@FProjectDescriptor@@SA?AVFString@@XZ
?GetFileExtension@FPluginDescriptor@@SAAEBVFString@@XZ
?HasDefaultPluginSettings@@YA_NAEBVFString@@@Z
?IsCompiledInConfiguration@FModuleDescriptor@@QEBA_NAEBVFString@@W4EBuildConfiguration@@0W4EBuildTargetType@@_N3@Z
?IsCompiledInCurrentConfiguration@FModuleDescriptor@@QEBA_NXZ
?IsEmpty@FCustomBuildSteps@@QEBA_NXZ
?IsEnabledForPlatform@FPluginReferenceDescriptor@@QEBA_NAEBVFString@@@Z
?IsEnabledForTarget@FPluginReferenceDescriptor@@QEBA_NW4EBuildTargetType@@@Z
?IsEnabledForTargetConfiguration@FPluginReferenceDescriptor@@QEBA_NW4EBuildConfiguration@@@Z
?IsLoadedInCurrentConfiguration@FModuleDescriptor@@QEBA_NXZ
?IsSigned@FProjectDescriptor@@QEBA_NAEBVFString@@@Z
?IsSupportedTargetPlatform@FPluginReferenceDescriptor@@QEBA_NAEBVFString@@@Z
?Load@FPluginDescriptor@@QEAA_NAEBVFString@@AEAVFText@@@Z
?Load@FPluginDescriptor@@QEAA_NAEBVFString@@PEAVFText@@@Z
?Load@FPluginManifest@@QEAA_NAEBVFString@@AEAVFText@@@Z
?Load@FProjectDescriptor@@QEAA_NAEBVFString@@AEAVFText@@@Z
?LoadModulesForPhase@FModuleDescriptor@@SAXW4Type@ELoadingPhase@@AEBV?$TArray@UFModuleDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@AEAV?$TMap@VFName@@W4EModuleLoadResult@@VFDefaultSetAllocator@@U?$TDefaultMapHashableKeyFuncs@VFName@@W4EModuleLoadResult@@$0A@@@@@@Z
?MakePathRelativeToProject@FProjectDescriptor@@AEBA?BVFString@@AEBV2@0@Z
?Read@FCustomBuildSteps@@QEAAXAEBVFJsonObject@@AEBVFString@@@Z
?Read@FLocalizationTargetDescriptor@@QEAA_NAEBVFJsonObject@@AEAVFText@@@Z
?Read@FLocalizationTargetDescriptor@@QEAA_NAEBVFJsonObject@@PEAVFText@@@Z
?Read@FModuleDescriptor@@QEAA_NAEBVFJsonObject@@AEAVFText@@@Z
?Read@FModuleDescriptor@@QEAA_NAEBVFJsonObject@@PEAVFText@@@Z
?Read@FPluginDescriptor@@QEAA_NAEBVFJsonObject@@AEAVFText@@@Z
?Read@FPluginDescriptor@@QEAA_NAEBVFJsonObject@@PEAVFText@@@Z
?Read@FPluginDescriptor@@QEAA_NAEBVFString@@AEAVFText@@@Z
?Read@FPluginDescriptor@@QEAA_NAEBVFString@@PEAVFText@@@Z
?Read@FPluginManifest@@QEAA_NAEBVFJsonObject@@AEAVFText@@@Z
?Read@FPluginReferenceDescriptor@@QEAA_NAEBV?$TSharedRef@VFJsonObject@@$00@@PEAVFText@@@Z
?Read@FPluginReferenceDescriptor@@QEAA_NAEBVFJsonObject@@AEAVFText@@V?$TSharedPtr@VFJsonObject@@$00@@@Z
?Read@FPluginReferenceDescriptor@@QEAA_NAEBVFJsonObject@@PEAVFText@@V?$TSharedPtr@VFJsonObject@@$00@@@Z
?Read@FProjectDescriptor@@QEAA_NAEBVFJsonObject@@AEBVFString@@AEAVFText@@@Z
?ReadArray@FLocalizationTargetDescriptor@@SA_NAEBVFJsonObject@@PEB_WAEAV?$TArray@UFLocalizationTargetDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@AEAVFText@@@Z
?ReadArray@FLocalizationTargetDescriptor@@SA_NAEBVFJsonObject@@PEB_WAEAV?$TArray@UFLocalizationTargetDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@PEAVFText@@@Z
?ReadArray@FModuleDescriptor@@SA_NAEBVFJsonObject@@PEB_WAEAV?$TArray@UFModuleDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@AEAVFText@@@Z
?ReadArray@FModuleDescriptor@@SA_NAEBVFJsonObject@@PEB_WAEAV?$TArray@UFModuleDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@PEAVFText@@@Z
?ReadArray@FPluginReferenceDescriptor@@SA_NAEBVFJsonObject@@PEB_WAEAV?$TArray@UFPluginReferenceDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@AEAVFText@@@Z
?ReadArray@FPluginReferenceDescriptor@@SA_NAEBVFJsonObject@@PEB_WAEAV?$TArray@UFPluginReferenceDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@PEAVFText@@@Z
?RemovePluginDirectory@FProjectDescriptor@@QEAA_NAEBVFString@@@Z
?RemoveRootDirectory@FProjectDescriptor@@QEAA_NAEBVFString@@@Z
?Save@FPluginDescriptor@@QEBA_NAEBVFString@@AEAVFText@@@Z
?Save@FPluginDescriptor@@QEBA_NAEBVFString@@PEAVFText@@@Z
?Save@FProjectDescriptor@@QEAA_NAEBVFString@@AEAVFText@@@Z
?ShouldLoadLocalizationTarget@FLocalizationTargetDescriptor@@QEBA_NXZ
?Sign@FProjectDescriptor@@QEAAXAEBVFString@@@Z
?SupportsTargetPlatform@FPluginDescriptor@@QEBA_NAEBVFString@@@Z
?ToString@EHostType@@YAPEB_WW4Type@1@@Z
?ToString@ELoadingPhase@@YAPEB_WW4Type@1@@Z
?ToString@ELocalizationTargetDescriptorLoadingPolicy@@YAPEB_WW4Type@1@@Z
?ToString@EVerseScope@@YAPEB_WW4Type@1@@Z
?UpdateArray@FLocalizationTargetDescriptor@@SAXAEAVFJsonObject@@PEB_WAEBV?$TArray@UFLocalizationTargetDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?UpdateArray@FModuleDescriptor@@SAXAEAVFJsonObject@@PEB_WAEBV?$TArray@UFModuleDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?UpdateArray@FPluginReferenceDescriptor@@SAXAEAVFJsonObject@@PEB_WAEBV?$TArray@UFPluginReferenceDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?UpdateJson@FCustomBuildSteps@@QEBAXAEAVFJsonObject@@AEBVFString@@@Z
?UpdateJson@FLocalizationTargetDescriptor@@QEBAXAEAVFJsonObject@@@Z
?UpdateJson@FModuleDescriptor@@QEBAXAEAVFJsonObject@@@Z
?UpdateJson@FPluginDescriptor@@QEBAXAEAVFJsonObject@@@Z
?UpdateJson@FPluginReferenceDescriptor@@QEBAXAEAVFJsonObject@@@Z
?UpdatePluginFile@FPluginDescriptor@@QEBA_NAEBVFString@@AEAVFText@@@Z
?UpdatePluginFile@FPluginDescriptor@@QEBA_NAEBVFString@@PEAVFText@@@Z
?UpdateSupportedTargetPlatforms@FProjectDescriptor@@QEAAXAEBVFName@@_N@Z
?Write@FCustomBuildSteps@@QEBAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@AEBVFString@@@Z
?Write@FLocalizationTargetDescriptor@@QEBAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@@Z
?Write@FModuleDescriptor@@QEBAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@@Z
?Write@FPluginDescriptor@@QEBAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@@Z
?Write@FPluginDescriptor@@QEBAXAEAVFString@@@Z
?Write@FPluginReferenceDescriptor@@QEBAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@@Z
?Write@FProjectDescriptor@@QEBAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@AEBVFString@@@Z
?WriteArray@FLocalizationTargetDescriptor@@SAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@PEB_WAEBV?$TArray@UFLocalizationTargetDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?WriteArray@FModuleDescriptor@@SAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@PEB_WAEBV?$TArray@UFModuleDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?WriteArray@FPluginReferenceDescriptor@@SAXAEAV?$TJsonWriter@_WU?$TPrettyJsonPrintPolicy@_W@@@@PEB_WAEBV?$TArray@UFPluginReferenceDescriptor@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
InitializeModule

Sections

.text
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26b88e29700dd4c6c136fae8d575b140

Headers

DLL Characteristics

File Characteristics

Imports

shadercompileworker-core

shadercompileworker-json

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 298KB - Virtual size: 297KB

.uedbg Size: 7KB - Virtual size: 6KB

.rdata Size: 107KB - Virtual size: 106KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 298KB - Virtual size: 297KB

.uedbg
Size: 7KB - Virtual size: 6KB

.rdata
Size: 107KB - Virtual size: 106KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 3KB - Virtual size: 2KB