NEAS[.]4fa2606ae0181fe7366509625cf06920[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4fa2606ae0181fe7366509625cf06920.exe
Size

315KB
MD5

4fa2606ae0181fe7366509625cf06920
SHA1

418874479c2763e1d5fc564cd887bb1f2f832087
SHA256

b0374338a7cf073c8cae5cc5e6c5df50e00b48627601387dc62405324a450f8f
SHA512

02d4b5fa20f3f627b65f500d2fc91619b02369ba8e7c3c821ce9b9dc5d618ed54b60eb1528e4d55053c6a7aadc5215071aec0acf66510ebbda9879e474844aeb
SSDEEP

6144:vHuIRzilJQDNBu4/lqmnRyAywcd5PaMhWCRZUmR/:vHu8zioDNBuWlRnRyAywcdkMhWyJl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4fa2606ae0181fe7366509625cf06920.exe

Files

NEAS.4fa2606ae0181fe7366509625cf06920.exe
.dll windows:6 windows x64

4f17a7b3cefa792587a461252a614ad6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

unrealserver-core-win64-shipping

??0FString@@QEAA@$$QEAV0@@Z
??0FString@@QEAA@AEBV0@@Z
??4FString@@QEAAAEAV0@$$QEAV0@@Z
??4FString@@QEAAAEAV0@AEBV0@@Z
??0FString@@QEAA@PEBD@Z
??0FString@@QEAA@PEB_W@Z
??4FString@@QEAAAEAV0@PEB_W@Z
?AssignRange@FString@@AEAAXPEB_WH@Z
?Empty@FString@@QEAAXXZ
?AppendChars@FString@@QEAAXPEB_WH@Z
?AppendChar@FString@@QEAAAEAV1@_W@Z
?ConcatFF@FString@@CA?AV1@AEBV1@$$QEAV1@@Z
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?AppendfImpl@FString@@CAXAEAV1@PEB_WZZ
??1FString@@QEAA@XZ
?InlineCombineSurrogates@StringConv@@YAXAEAVFString@@@Z
?ToString@FName@@QEBA?AVFString@@XZ
?Logf_InternalImpl@FMsg@@CAXPEBDHAEBVFName@@W4Type@ELogVerbosity@@PEB_WZZ
?ToIso8601@FDateTime@@QEBA?AVFString@@XZ
?ParseIso8601@FDateTime@@SA_NPEB_WAEAU1@@Z
??4FText@@QEAAAEAV0@$$QEAV0@@Z
?FromString@FText@@SA?AV1@$$QEAVFString@@@Z
?ToString@FText@@QEBAAEBVFString@@XZ
??1FText@@QEAA@XZ
?GetArchiveName@FArchiveState@@UEBA?AVFString@@XZ
?Close@FArchive@@UEAA_NXZ
?GetInnermostState@FArchiveState@@UEAAAEAU1@XZ
?CountBytes@FArchiveState@@UEAAX_K0@Z
?GetLinker@FArchiveState@@UEAAPEAVFLinker@@XZ
?GetArchetypeFromLoader@FArchiveState@@UEAAPEAVUObject@@PEBV2@@Z
?GetCustomVersions@FArchiveState@@UEBAAEBVFCustomVersionContainer@@XZ
?SetCustomVersions@FArchiveState@@UEAAXAEBVFCustomVersionContainer@@@Z
?ResetCustomVersions@FArchiveState@@UEAAXXZ
?SetFilterEditorOnly@FArchiveState@@UEAAX_N@Z
?UseToResolveEnumerators@FArchiveState@@UEBA_NXZ
?ShouldSkipProperty@FArchiveState@@UEBA_NPEBVFProperty@@@Z
?SetSerializedProperty@FArchiveState@@UEAAXPEAVFProperty@@@Z
?SetSerializedPropertyChain@FArchiveState@@UEAAXPEBUFArchiveSerializedPropertyChain@@PEAVFProperty@@@Z
?SetSerializeContext@FArchiveState@@UEAAXPEAUFUObjectSerializeContext@@@Z
?GetSerializeContext@FArchiveState@@UEAAPEAUFUObjectSerializeContext@@XZ
?Reset@FArchiveState@@UEAAXXZ
?SetIsLoading@FArchiveState@@UEAAX_N@Z
?SetIsLoadingFromCookedPackage@FArchiveState@@UEAAX_N@Z
?SetIsSaving@FArchiveState@@UEAAX_N@Z
?SetIsTransacting@FArchiveState@@UEAAX_N@Z
?SetIsTextFormat@FArchiveState@@UEAAX_N@Z
?SetWantBinaryPropertySerialization@FArchiveState@@UEAAX_N@Z
?SetUseUnversionedPropertySerialization@FArchiveState@@UEAAX_N@Z
?SetForceUnicode@FArchiveState@@UEAAX_N@Z
?SetIsPersistent@FArchiveState@@UEAAX_N@Z
?SetUEVer@FArchiveState@@UEAAXUFPackageFileVersion@@@Z
?SetLicenseeUEVer@FArchiveState@@UEAAXH@Z
?SetEngineVer@FArchiveState@@UEAAXAEBVFEngineVersionBase@@@Z
?SetEngineNetVer@FArchiveState@@UEAAXI@Z
?SetGameNetVer@FArchiveState@@UEAAXI@Z
??6FArchive@@UEAAAEAV0@AEAUFWeakObjectPtr@@@Z
?OnInvalidArrayNum@UE4Array_Private@@YAXPEB_W_K@Z
??6FArchive@@UEAAAEAV0@AEAUFSoftObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAUFObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAUFLazyObjectPtr@@@Z
??6FArchive@@UEAAAEAV0@AEAPEAVFField@@@Z
??6FArchive@@UEAAAEAV0@AEAPEAVUObject@@@Z
??6FArchive@@UEAAAEAV0@AEAVFText@@@Z
??6FArchive@@UEAAAEAV0@AEAVFName@@@Z
?ForceBlueprintFinalization@FArchive@@UEAAXXZ
?SerializeBits@FArchive@@UEAAXPEAX_J@Z
?SerializeInt@FArchive@@UEAAXAEAII@Z
?SerializeIntPacked@FArchive@@UEAAXAEAI@Z
?Preload@FArchive@@UEAAXPEAVUObject@@@Z
?AttachBulkData@FArchive@@UEAAXPEAVFEditorBulkData@Serialization@UE@@@Z
?AttachBulkData@FArchive@@UEAAXPEAVUObject@@PEAVFBulkData@@@Z
?DetachBulkData@FArchive@@UEAAXPEAVFEditorBulkData@Serialization@UE@@_N@Z
?DetachBulkData@FArchive@@UEAAXPEAVFBulkData@@_N@Z
?IsProxyOf@FArchive@@UEBA_NPEAV1@@Z
?Precache@FArchive@@UEAA_N_J0@Z
?FlushCache@FArchive@@UEAAXXZ
?SetCompressionMap@FArchive@@UEAA_NPEAV?$TArray@UFCompressedChunk@@V?$TSizedDefaultAllocator@$0CA@@@@@W4ECompressionFlags@@@Z
?Flush@FArchive@@UEAAXXZ
?MarkScriptSerializationStart@FArchive@@UEAAXPEBVUObject@@@Z
?MarkScriptSerializationEnd@FArchive@@UEAAXPEBVUObject@@@Z
?MarkSearchableName@FArchive@@UEBAXPEBVUObject@@AEBVFName@@@Z
?UsingCustomVersion@FArchive@@UEAAXAEBUFGuid@@@Z
?GetCacheableArchive@FArchive@@UEAAPEAV1@XZ
?PushSerializedProperty@FArchive@@UEAAXPEAVFProperty@@_N@Z
?PopSerializedProperty@FArchive@@UEAAXPEAVFProperty@@_N@Z
?AttachExternalReadDependency@FArchive@@UEAA_NAEAV?$TFunction@$$A6A_NN@Z@@@Z
?PushFileRegionType@FArchive@@UEAAXW4EFileRegionType@@@Z
?PopFileRegionType@FArchive@@UEAAXXZ
?AtEnd@FArchiveState@@UEAA_NXZ
?CRCTable_DEPRECATED@FCrc@@2PAIA
?LogSerialization@@3UFLogCategoryLogSerialization@@A
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPath@Private@ObjectPath@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@@EA
?Singleton@IConsoleManager@@0PEAU1@EA
?Malloc@FMemory@@SAPEAX_KI@Z
?SetError@FArchiveState@@QEAAXXZ
?SerializeByteOrderSwapped@FArchive@@AEAAAEAV1@AEAI@Z
?ConcatFF@FString@@CA?AV1@$$QEAV1@AEBV1@@Z
?ConcatFC@FString@@CA?AV1@AEBV1@PEB_W@Z
?ToLower@FString@@QEGBA?AV1@XZ
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?GenerateNewID@FDelegateHandle@@CA_KXZ
?Value@FParse@@SA_NPEB_W0AEAVFString@@_N@Z
?GetSecondsPerCycle@FGenericPlatformTime@@SANXZ
?SetupSingleton@IConsoleManager@@CAXXZ
??0FAutoConsoleObject@@IEAA@PEAVIConsoleObject@@@Z
??1FAutoConsoleObject@@UEAA@XZ
?Get@FCommandLine@@SAPEB_WXZ
?GetString@FConfigCacheIni@@QEAA_NPEB_W0AEAVFString@@AEBV2@@Z
?GConfig@@3PEAVFConfigCacheIni@@EA
?GEngineIni@@3VFString@@A
??6@YAAEAVFArchive@@AEAV0@AEAVFString@@@Z
??0FArchive@@QEAA@AEBV0@@Z
??0FArchive@@QEAA@XZ
??1FArchiveState@@EEAA@XZ
??4FArchiveState@@AEAAAEAU0@AEBU0@@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?CheckVerifyFailedImpl@FDebug@@SAXPEBD0HPEAXPEB_WZZ
?ProcessFatalError@FDebug@@SAXPEAX@Z
?Stricmp@FGenericPlatformStricmp@@SAHPEB_W0@Z
??1FLogCategoryBase@@QEAA@XZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
??0FName@@QEAA@PEB_WW4EFindName@@@Z
?Free@FMemory@@SAXPEAX@Z
?ZeroVector@?$TVector@N@Math@UE@@2U123@B
??0FString@@QEAA@XZ
??6FArchive@@UEAAAEAV0@AEAUFSoftObjectPath@@@Z

unrealserver-coreuobject-win64-shipping

?ConstructUEnum@UECodeGen_Private@@YAXAEAPEAVUEnum@@AEBUFEnumParams@1@@Z
?GetStaticEnum@@YAPEAVUEnum@@P6APEAV1@XZPEAVUObject@@PEB_W@Z
?RegisterCompiledInInfo@@YAXP6APEAVUPackage@@XZPEB_WAEAU?$TRegistrationInfo@VUPackage@@UFPackageReloadVersionInfo@@@@AEBUFPackageReloadVersionInfo@@@Z
??4FWeakObjectPtr@@QEAAXPEBVUObject@@@Z
?ConstructUPackage@UECodeGen_Private@@YAXAEAPEAVUPackage@@AEBUFPackageParams@1@@Z
?RegisterCompiledInInfo@@YAXPEB_WPEBUFClassRegisterCompiledInInfo@@_KPEBUFStructRegisterCompiledInInfo@@2PEBUFEnumRegisterCompiledInInfo@@2@Z

unrealserver-engine-win64-shipping

?GetLocalPlayerFromControllerId@UEngine@@QEBAPEAVULocalPlayer@@PEAVUWorld@@H@Z
??0FTickableGameObject@@QEAA@XZ
??1FTickableGameObject@@UEAA@XZ
??0FTickableGameObject@@QEAA@AEBV0@@Z
?GetTickableGameObjectWorld@FTickableGameObject@@UEBAPEAVUWorld@@XZ
?IsTickableInEditor@FTickableGameObject@@UEBA_NXZ
?IsAllowedToTick@FTickableObjectBase@@UEBA_NXZ
?IsTickable@FTickableObjectBase@@UEBA_NXZ
?GWorld@@3VUWorldProxy@@A
?GEngine@@3PEAVUEngine@@EA

unrealserver-http-win64-shipping

?Get@FHttpModule@@SAAEAV1@XZ
?UrlEncode@FGenericPlatformHttp@@SA?AVFString@@V?$TStringView@_W@@@Z

unrealserver-networkreplaystreaming-win64-shipping

?GetLastError@INetworkReplayStreamer@@UEBA?AW4Type@ENetworkReplayError@@XZ
??0INetworkReplayStreamer@@QEAA@XZ
?HasError@INetworkReplayStreamer@@UEBA_NXZ
?HandleLastError@INetworkReplayStreamer@@UEAA?AW4EHandleNetResult@Net@UE@@AEAVFNetResultManager@34@@Z
?SetExtendedError@INetworkReplayStreamer@@UEAAX$$QEAUFNetResult@Net@UE@@@Z
?AppendCommonReplayAttributes@INetworkReplayStreamer@@UEBA?AV?$TArray@UFAnalyticsEventAttribute@@V?$TSizedDefaultAllocator@$0CA@@@@@$$QEAV2@@Z
?Exec@INetworkReplayStreamer@@UEAAXPEB_WAEAVFOutputDevice@@@Z
??1INetworkReplayStreamer@@UEAA@XZ
??0INetworkReplayStreamer@@QEAA@AEBV0@@Z
??4INetworkReplayStreamer@@QEAAAEAV0@AEBV0@@Z
?SetAnalyticsProvider@INetworkReplayStreamer@@UEAAXAEAV?$TSharedPtr@VIAnalyticsProvider@@$00@@@Z

unrealserver-json-win64-shipping

??0FJsonValueNumberString@@QEAA@AEBVFString@@@Z
??1FJsonValueNumberString@@UEAA@XZ
??0FJsonValueBoolean@@QEAA@_N@Z
??1FJsonValueBoolean@@UEAA@XZ
??0FJsonValueArray@@QEAA@AEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
??1FJsonValueArray@@UEAA@XZ
??0FJsonValueObject@@QEAA@V?$TSharedPtr@VFJsonObject@@$00@@@Z
??1FJsonValueObject@@UEAA@XZ
??0FJsonValueNull@@QEAA@XZ
??1FJsonValueNull@@UEAA@XZ
?SetField@FJsonObject@@QEAAXAEBVFString@@AEBV?$TSharedPtr@VFJsonValue@@$00@@@Z
?GetNumberField@FJsonObject@@QEBANAEBVFString@@@Z
?TryGetNumberField@FJsonObject@@QEBA_NAEBVFString@@AEAH@Z
?TryGetNumberField@FJsonObject@@QEBA_NAEBVFString@@AEA_J@Z
?TryGetNumberField@FJsonObject@@QEBA_NAEBVFString@@AEAI@Z
?GetStringField@FJsonObject@@QEBA?AVFString@@AEBV2@@Z
?GetBoolField@FJsonObject@@QEBA_NAEBVFString@@@Z
?GetArrayField@FJsonObject@@QEBAAEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@AEBVFString@@@Z
?GetObjectField@FJsonObject@@QEBAAEBV?$TSharedPtr@VFJsonObject@@$00@@AEBVFString@@@Z
??0FJsonObject@@QEAA@XZ
??1FJsonObject@@QEAA@XZ
?TryGetObject@FJsonValueObject@@UEAA_NAEAPEAV?$TSharedPtr@VFJsonObject@@$00@@@Z
?TryGetObject@FJsonValueObject@@UEBA_NAEAPEBV?$TSharedPtr@VFJsonObject@@$00@@@Z
?GetType@FJsonValueObject@@MEBA?AVFString@@XZ
?TryGetArray@FJsonValueArray@@UEAA_NAEAPEAV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?TryGetArray@FJsonValueArray@@UEBA_NAEAPEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?GetType@FJsonValueArray@@MEBA?AVFString@@XZ
?TryGetNumber@FJsonValueBoolean@@UEBA_NAEAN@Z
?TryGetString@FJsonValueBoolean@@UEBA_NAEAVFString@@@Z
?TryGetBool@FJsonValueBoolean@@UEBA_NAEA_N@Z
?GetType@FJsonValueBoolean@@MEBA?AVFString@@XZ
?TryGetNumber@FJsonValueString@@UEBA_NAEA_K@Z
?TryGetNumber@FJsonValueString@@UEBA_NAEAI@Z
?TryGetNumber@FJsonValueString@@UEBA_NAEA_J@Z
?TryGetNumber@FJsonValueString@@UEBA_NAEAH@Z
?TryGetNumber@FJsonValueString@@UEBA_NAEAN@Z
?TryGetString@FJsonValueString@@UEBA_NAEAVFString@@@Z
??1FJsonValueNumber@@UEAA@XZ
?GetType@FJsonValueString@@MEBA?AVFString@@XZ
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEA_K@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAI@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAG@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAE@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEA_J@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAH@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAF@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAC@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAM@Z
?TryGetNumber@FJsonValueNumberString@@UEBA_NAEAN@Z
?TryGetString@FJsonValueNumberString@@UEBA_NAEAVFString@@@Z
??0FJsonValueString@@QEAA@AEBVFString@@@Z
?GetType@FJsonValueNumberString@@MEBA?AVFString@@XZ
?TryGetNumber@FJsonValueNumber@@UEBA_NAEAN@Z
?TryGetString@FJsonValueNumber@@UEBA_NAEAVFString@@@Z
?TryGetBool@FJsonValueNumber@@UEBA_NAEA_N@Z
?GetType@FJsonValueNumber@@MEBA?AVFString@@XZ
?AsObject@FJsonValue@@UEBAAEBV?$TSharedPtr@VFJsonObject@@$00@@XZ
?TryGetNumber@FJsonValue@@UEBA_NAEA_K@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAI@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAG@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAE@Z
?TryGetNumber@FJsonValue@@UEBA_NAEA_J@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAH@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAF@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAC@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAM@Z
?TryGetNumber@FJsonValue@@UEBA_NAEAN@Z
?TryGetBool@FJsonValue@@UEBA_NAEA_N@Z
?TryGetArray@FJsonValue@@UEAA_NAEAPEAV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?TryGetArray@FJsonValue@@UEBA_NAEAPEBV?$TArray@V?$TSharedPtr@VFJsonValue@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?TryGetObject@FJsonValue@@UEAA_NAEAPEAV?$TSharedPtr@VFJsonObject@@$00@@@Z
?TryGetObject@FJsonValue@@UEBA_NAEAPEBV?$TSharedPtr@VFJsonObject@@$00@@@Z
?GetType@FJsonValueNull@@MEBA?AVFString@@XZ
?TryGetString@FJsonValue@@UEBA_NAEAVFString@@@Z
??0FJsonValueNumber@@QEAA@N@Z
?AsString@FJsonValue@@QEBA?AVFString@@XZ
?AsNumber@FJsonValue@@QEBANXZ
?TryGetBool@FJsonValueString@@UEBA_NAEA_N@Z
??1FJsonValueString@@UEAA@XZ
?TryGetBool@FJsonValueNumberString@@UEBA_NAEA_N@Z

kernel32

InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
QueryPerformanceCounter

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memset
_purecall
memcpy
memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstod

api-ms-win-crt-math-l1-1-0

logf
powf

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_crt_atexit
_initialize_narrow_environment
_initterm_e
_initialize_onexit_table
_register_onexit_function
_cexit
_initterm

Exports

Exports

??$StaticEnum@W4EHttpReplayResult@@@@YAPEAVUEnum@@XZ
??0FHttpNetworkReplayStreamer@@QEAA@$$QEAV0@@Z
??0FHttpNetworkReplayStreamer@@QEAA@AEBV0@@Z
??0FHttpNetworkReplayStreamer@@QEAA@XZ
??0FHttpNetworkReplayStreamingFactory@@QEAA@$$QEAV0@@Z
??0FHttpNetworkReplayStreamingFactory@@QEAA@AEBV0@@Z
??0FHttpNetworkReplayStreamingFactory@@QEAA@XZ
??0FHttpStreamFArchive@@QEAA@$$QEAV0@@Z
??0FHttpStreamFArchive@@QEAA@AEBV0@@Z
??0FHttpStreamFArchive@@QEAA@XZ
??1FHttpNetworkReplayStreamer@@UEAA@XZ
??1FHttpNetworkReplayStreamingFactory@@UEAA@XZ
??1FHttpStreamFArchive@@UEAA@XZ
??4FHttpNetworkReplayStreamer@@QEAAAEAV0@$$QEAV0@@Z
??4FHttpNetworkReplayStreamer@@QEAAAEAV0@AEBV0@@Z
??4FHttpNetworkReplayStreamingFactory@@QEAAAEAV0@$$QEAV0@@Z
??4FHttpNetworkReplayStreamingFactory@@QEAAAEAV0@AEBV0@@Z
??4FHttpStreamFArchive@@QEAAAEAV0@$$QEAV0@@Z
??4FHttpStreamFArchive@@QEAAAEAV0@AEBV0@@Z
??_7FHttpNetworkReplayStreamer@@6B@
??_7FHttpNetworkReplayStreamingFactory@@6BFTickableGameObject@@@
??_7FHttpNetworkReplayStreamingFactory@@6BINetworkReplayStreamingFactory@@@
??_7FHttpStreamFArchive@@6B@
?AddCustomRequestToQueue@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VFQueuedHttpRequest@@$00@@@Z
?AddEvent@FHttpNetworkReplayStreamer@@UEAAXIAEBVFString@@0AEBV?$TArray@EV?$TSizedDefaultAllocator@$0CA@@@@@@Z
?AddOrUpdateEvent@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@I00AEBV?$TArray@EV?$TSizedDefaultAllocator@$0CA@@@@@@Z
?AddRequestToQueue@FHttpNetworkReplayStreamer@@QEAAXW4Type@EQueuedHttpRequestType@@V?$TSharedPtr@VIHttpRequest@@$00@@HM@Z
?AddResponseToCache@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@@Z
?AddUserToReplay@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@@Z
?AtEnd@FHttpStreamFArchive@@UEAA_NXZ
?CancelInFlightOrPendingTask@FHttpNetworkReplayStreamer@@QEAAXW4Type@EQueuedHttpRequestType@@@Z
?CancelStreamingRequests@FHttpNetworkReplayStreamer@@UEAAXXZ
?CleanupResponseCache@FHttpNetworkReplayStreamer@@QEAAXXZ
?CompressBuffer@FHttpNetworkReplayStreamer@@UEBA_NAEBV?$TArray@EV?$TSizedDefaultAllocator@$0CA@@@@@AEAVFHttpStreamFArchive@@@Z
?CompressRequest@FHttpNetworkReplayStreamer@@UEBA_NV?$TSharedPtr@VIHttpRequest@@$00@@AEBV?$TArray@EV?$TSizedDefaultAllocator@$0CA@@@@@@Z
?ConditionallyDownloadNextChunk@FHttpNetworkReplayStreamer@@QEAAXXZ
?ConditionallyEnumerateCheckpoints@FHttpNetworkReplayStreamer@@QEAAXXZ
?ConditionallyFlushStream@FHttpNetworkReplayStreamer@@QEAAXXZ
?ConditionallyRefreshViewer@FHttpNetworkReplayStreamer@@QEAAXXZ
?CreateReplayStreamer@FHttpNetworkReplayStreamingFactory@@UEAA?AV?$TSharedPtr@VINetworkReplayStreamer@@$00@@XZ
?DecompressBuffer@FHttpNetworkReplayStreamer@@UEBA_NAEAVFHttpStreamFArchive@@AEAV?$TArray@EV?$TSizedDefaultAllocator@$0CA@@@@@@Z
?DecompressResponse@FHttpNetworkReplayStreamer@@UEBA_NV?$TSharedPtr@VIHttpResponse@@$00@@AEAV?$TArray@EV?$TSizedDefaultAllocator@$0CA@@@@@@Z
?DeleteFinishedStream@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@AEBV?$TDelegate@$$A6AXAEBUFDeleteFinishedStreamResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?DeleteFinishedStream@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@HAEBV?$TDelegate@$$A6AXAEBUFDeleteFinishedStreamResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?DownloadHeader@FHttpNetworkReplayStreamer@@UEAAXAEBV?$TDelegate@$$A6AXAEBUFDownloadHeaderResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?EnumerateCheckpoints@FHttpNetworkReplayStreamer@@QEAAXXZ
?EnumerateEvents@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0AEBV?$TDelegate@$$A6AXAEBUFEnumerateEventsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?EnumerateEvents@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0HAEBV?$TDelegate@$$A6AXAEBUFEnumerateEventsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?EnumerateEvents@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@AEBV?$TDelegate@$$A6AXAEBUFEnumerateEventsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?EnumerateRecentStreams@FHttpNetworkReplayStreamer@@UEAAXAEBVFNetworkReplayVersion@@HAEBV?$TDelegate@$$A6AXAEBUFEnumerateStreamsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?EnumerateStreams@FHttpNetworkReplayStreamer@@UEAAXAEBVFNetworkReplayVersion@@HAEBVFString@@AEBV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@AEBV?$TDelegate@$$A6AXAEBUFEnumerateStreamsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?FlushCheckpoint@FHttpNetworkReplayStreamer@@UEAAXI@Z
?FlushCheckpointInternal@FHttpNetworkReplayStreamer@@QEAAXI@Z
?FlushStream@FHttpNetworkReplayStreamer@@QEAAXXZ
?GetCheckpointArchive@FHttpNetworkReplayStreamer@@UEAAPEAVFArchive@@XZ
?GetDemoPath@FHttpNetworkReplayStreamer@@UEBA?AW4EStreamingOperationResult@@AEAVFString@@@Z
?GetHeaderArchive@FHttpNetworkReplayStreamer@@UEAAPEAVFArchive@@XZ
?GetMaxFriendlyNameSize@FHttpNetworkReplayStreamer@@UEBAIXZ
?GetRecordingMetadata@FHttpNetworkReplayStreamer@@UEBA?AVFString@@XZ
?GetReplayID@FHttpNetworkReplayStreamer@@UEBA?AVFString@@XZ
?GetReplayStreamerState@FHttpNetworkReplayStreamer@@UEBA?AW4EReplayStreamerState@@XZ
?GetStatId@FHttpNetworkReplayStreamingFactory@@UEBA?AUTStatId@@XZ
?GetStreamingArchive@FHttpNetworkReplayStreamer@@UEAAPEAVFArchive@@XZ
?GetTickableTickType@FHttpNetworkReplayStreamingFactory@@UEBA?AW4ETickableTickType@@XZ
?GetTotalDemoTime@FHttpNetworkReplayStreamer@@UEBAIXZ
?GotoCheckpointIndex@FHttpNetworkReplayStreamer@@UEAAXHAEBV?$TDelegate@$$A6AXAEBUFGotoResult@@@ZUFDefaultDelegateUserPolicy@@@@W4EReplayCheckpointType@@@Z
?GotoTimeInMS@FHttpNetworkReplayStreamer@@UEAAXIAEBV?$TDelegate@$$A6AXAEBUFGotoResult@@@ZUFDefaultDelegateUserPolicy@@@@W4EReplayCheckpointType@@@Z
?HasPendingHttpRequests@FHttpNetworkReplayStreamer@@QEBA_NXZ
?HttpAddUserFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpDownloadCheckpointDeltaFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpDownloadCheckpointFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpDownloadFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_NH2@Z
?HttpDownloadHeaderFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_NV?$TDelegate@$$A6AXAEBUFDownloadHeaderResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?HttpEnumerateCheckpointsFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpEnumerateEventsFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_NV?$TDelegate@$$A6AXAEBUFEnumerateEventsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?HttpEnumerateSessionsFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_NV?$TDelegate@$$A6AXAEBUFEnumerateStreamsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?HttpHeaderUploadFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpRefreshViewerFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpRequestEventDataFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_NV?$TDelegate@$$A6AXAEBUFRequestEventDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?HttpStartDownloadingFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpStartUploadingFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpStopUploadingFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpUploadCheckpointFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpUploadCustomEventFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?HttpUploadStreamFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?IsCheckpointTypeSupported@FHttpNetworkReplayStreamer@@UEBA_NW4EReplayCheckpointType@@@Z
?IsDataAvailable@FHttpNetworkReplayStreamer@@UEBA_NXZ
?IsDataAvailableForTimeRange@FHttpNetworkReplayStreamer@@UEAA_NII@Z
?IsHttpRequestInFlight@FHttpNetworkReplayStreamer@@QEBA_NXZ
?IsLive@FHttpNetworkReplayStreamer@@UEBA_NXZ
?IsLoadingCheckpoint@FHttpNetworkReplayStreamer@@UEBA_NXZ
?IsStreaming@FHttpNetworkReplayStreamer@@QEBA_NXZ
?IsTaskPendingOrInFlight@FHttpNetworkReplayStreamer@@QEBA_NW4Type@EQueuedHttpRequestType@@@Z
?IsTickableWhenPaused@FHttpNetworkReplayStreamingFactory@@UEBA_NXZ
?KeepReplay@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@_NAEBV?$TDelegate@$$A6AXAEBUFKeepReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?KeepReplay@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@_NHAEBV?$TDelegate@$$A6AXAEBUFKeepReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?KeepReplayFinished@FHttpNetworkReplayStreamer@@QEAAXV?$TSharedPtr@VIHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_NV?$TDelegate@$$A6AXAEBUFKeepReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@VFString@@@Z
?LexToString@@YAPEB_WW4EHttpReplayResult@@@Z
?ProcessNextHttpRequest@FHttpNetworkReplayStreamer@@QEAA_NXZ
?ProcessRequestInternal@FHttpNetworkReplayStreamer@@UEAAXV?$TSharedPtr@VIHttpRequest@@$00@@@Z
?RefreshHeader@FHttpNetworkReplayStreamer@@UEAAXXZ
?RefreshViewer@FHttpNetworkReplayStreamer@@QEAAX_N@Z
?RenameReplay@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0AEBV?$TDelegate@$$A6AXAEBUFRenameReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RenameReplay@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0HAEBV?$TDelegate@$$A6AXAEBUFRenameReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RenameReplayFriendlyName@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0AEBV?$TDelegate@$$A6AXAEBUFRenameReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RenameReplayFriendlyName@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0HAEBV?$TDelegate@$$A6AXAEBUFRenameReplayResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestEventData@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0AEBV?$TDelegate@$$A6AXAEBUFRequestEventDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestEventData@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0HAEBV?$TDelegate@$$A6AXAEBUFRequestEventDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestEventData@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@AEBV?$TDelegate@$$A6AXAEBUFRequestEventDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestEventGroupData@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0AEBV?$TDelegate@$$A6AXAEBUFRequestEventGroupDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestEventGroupData@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@0HAEBV?$TDelegate@$$A6AXAEBUFRequestEventGroupDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestEventGroupData@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@AEBV?$TDelegate@$$A6AXAEBUFRequestEventGroupDataResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?RequestFinished@FHttpNetworkReplayStreamer@@QEAAXW4EReplayStreamerState@@W4Type@EQueuedHttpRequestType@@V?$TSharedPtr@VIHttpRequest@@$00@@@Z
?RetryRequest@FHttpNetworkReplayStreamer@@QEAA_NV?$TSharedPtr@VFQueuedHttpRequest@@$00@@V?$TSharedPtr@VIHttpResponse@@$00@@_N@Z
?SearchEvents@FHttpNetworkReplayStreamer@@UEAAXAEBVFString@@AEBV?$TDelegate@$$A6AXAEBUFSearchEventsResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?Seek@FHttpStreamFArchive@@UEAAX_J@Z
?Serialize@FHttpStreamFArchive@@UEAAXPEAX_J@Z
?SetDemoPath@FHttpNetworkReplayStreamer@@UEAA?AW4EStreamingOperationResult@@AEBVFString@@@Z
?SetHighPriorityTimeRange@FHttpNetworkReplayStreamer@@UEAAXII@Z
?SetLastError@FHttpNetworkReplayStreamer@@QEAAX$$QEAU?$TNetResult@W4EHttpReplayResult@@@Net@UE@@@Z
?SetLastError@FHttpNetworkReplayStreamer@@QEAAXW4Type@ENetworkReplayError@@@Z
?SetTimeBufferHintSeconds@FHttpNetworkReplayStreamer@@UEAAXM@Z
?StartStreaming@FHttpNetworkReplayStreamer@@UEAAXAEBUFStartStreamingParameters@@AEBV?$TDelegate@$$A6AXAEBUFStartStreamingResult@@@ZUFDefaultDelegateUserPolicy@@@@@Z
?StopStreaming@FHttpNetworkReplayStreamer@@UEAAXXZ
?StopUploading@FHttpNetworkReplayStreamer@@QEAAXXZ
?SupportsCompression@FHttpNetworkReplayStreamer@@UEBA_NXZ
?Tell@FHttpStreamFArchive@@UEAA_JXZ
?Tick@FHttpNetworkReplayStreamer@@QEAAXM@Z
?Tick@FHttpNetworkReplayStreamingFactory@@UEAAXM@Z
?TotalSize@FHttpStreamFArchive@@UEAA_JXZ
?UpdatePlaybackTime@FHttpNetworkReplayStreamer@@UEAAXI@Z
?UpdateTotalDemoTime@FHttpNetworkReplayStreamer@@UEAAXI@Z
?UploadHeader@FHttpNetworkReplayStreamer@@QEAAXXZ
?Z_Construct_UEnum_HttpNetworkReplayStreaming_EHttpReplayResult@@YAPEAVUEnum@@XZ
InitializeModule

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f17a7b3cefa792587a461252a614ad6

Headers

DLL Characteristics

File Characteristics

Imports

unrealserver-core-win64-shipping

unrealserver-coreuobject-win64-shipping

unrealserver-engine-win64-shipping

unrealserver-http-win64-shipping

unrealserver-networkreplaystreaming-win64-shipping

unrealserver-json-win64-shipping

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 152KB

.uedbg Size: 7KB - Virtual size: 6KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 59KB - Virtual size: 59KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 152KB - Virtual size: 152KB

.uedbg
Size: 7KB - Virtual size: 6KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 59KB - Virtual size: 59KB

.reloc
Size: 2KB - Virtual size: 1KB