4c9cf7034f5f03b389456846d26f5e48df0ad5bc7028e378607287df2d097c24_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4c9cf7034f5f03b389456846d26f5e48df0ad5bc7028e378607287df2d097c24_NeikiAnalytics.exe
Size

352KB
MD5

7ed858cac3a7d91a3609fa4fee9f9000
SHA1

cebb188bebb989b11c3cd6e9719a66c0d41dcb60
SHA256

4c9cf7034f5f03b389456846d26f5e48df0ad5bc7028e378607287df2d097c24
SHA512

fd277fe885c699089332ee9c0d817b2fb3e044612d10497dd8734f85e8307aecd90fc20b756f91f056e9809f573e7d706841a142b7a1bc02a91cbf888dec4560
SSDEEP

3072:xlfSXpLo45K8YyWjAIb/sry1mHOKcyLl+nVA04YuaB/nVxTOWoZVBIuv1AEmWK4o:xkirsqyLIXx9R69rRZUmR/L6

Score

1^/10

Malware Config

Signatures

Files

4c9cf7034f5f03b389456846d26f5e48df0ad5bc7028e378607287df2d097c24_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

4917567849d98321dbf580628df39ee6

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:dd:d2:bf:a6:72:e1:01:5a:f0:0f:f1
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

16-05-2024 13:07

Not After

17-05-2025 13:07

Subject

SERIALNUMBER=556821-8225,CN=Coffee Stain Studios AB,O=Coffee Stain Studios AB,STREET=Hertig Johans Gata 6,L=Skövde,ST=Västra Götaland,C=SE,1.2.840.113549.1.9.1=#0c14637373697440636f66666565737461696e2e7365,1.3.6.1.4.1.311.60.2.1.3=#13025345,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:38:fa:e2:eb:08:48:22:f5:ba:1e:d9:dc:09:c2:2a:2d:08:0f:ba:91:9d:2e:c6:ff:97:a3:7d:67:0d:51:d5
Signer

Actual PE Digest

20:38:fa:e2:eb:08:48:22:f5:ba:1e:d9:dc:09:c2:2a:2d:08:0f:ba:91:9d:2e:c6:ff:97:a3:7d:67:0d:51:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FactoryServer-OnlineServicesInterface.pdb

Imports

factoryserver-core

??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?Stricmp@FGenericPlatformStricmp@@SAHPEB_W0@Z
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?CheckVerifyImpl@@YA_NAEA_N_NPEBDHPEAX2PEB_WZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?OnInvalidSetNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
?FromCStringWide@FToBoolHelper@@SA_NPEB_W@Z
??0FString@@QEAA@PEBD@Z
??0FString@@QEAA@PEB_W@Z
??0FString@@QEAA@HPEB_W@Z
?AppendChars@FString@@QEAAXPEB_WH@Z
?ToLower@FString@@QEHAA?AV1@XZ
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?ParseIntoArray@FString@@QEBAHAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@PEB_W_N@Z
?GetTypeHash@@YAIUFNameEntryId@@@Z
?ToString@FName@@QEBA?AVFString@@XZ
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?Value@FParse@@SA_NPEB_W0AEAVFString@@_NPEAPEB_W@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetNetworkCompatibleChangelist@FNetworkVersion@@SAIXZ
??0FTextFormat@@QEAA@AEBVFText@@@Z
??0FText@@QEAA@XZ
?FromString@FText@@SA?AV1@AEBVFString@@@Z
?FromString@FText@@SA?AV1@$$QEAVFString@@@Z
?ToString@FText@@QEBAAEBVFString@@XZ
?Format@FText@@SA?AV1@VFTextFormat@@AEBV?$TSortedMap@VFString@@VFFormatArgumentValue@@V?$TSizedDefaultAllocator@$0CA@@@UFLocKeySortedMapLess@@@@@Z
?ForUseOnlyByLocMacroAndGraphNodeTextLiterals_CreateText@FInternationalization@@SA?AVFText@@PEB_W00@Z
?ToString@FDateTime@@QEBA?AVFString@@XZ
?SetupSingleton@IConsoleManager@@CAXXZ
?AccessGeneralShaderChangeCvars@FAutoConsoleObject@@SAAEAV?$TArray@PEBVFAutoConsoleObject@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?AccessMobileShaderChangeCvars@FAutoConsoleObject@@SAAEAV?$TArray@PEBVFAutoConsoleObject@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?AccessDesktopShaderChangeCvars@FAutoConsoleObject@@SAAEAV?$TArray@PEBVFAutoConsoleObject@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?Get@FCommandLine@@SAPEB_WXZ
?GetString@FConfigCacheIni@@QEAA_NPEB_W0AEAVFString@@AEBV2@@Z
?GetInt@FConfigCacheIni@@QEAA_NPEB_W0AEAHAEBVFString@@@Z
?GetBool@FConfigCacheIni@@QEAA_NPEB_W0AEA_NAEBVFString@@@Z
?SetName@FCbWriter@@QEAAAEAV1@V?$TStringView@W4UTF8CHAR@FGenericPlatformTypes@@@@@Z
?BeginObject@FCbWriter@@QEAAXXZ
?EndObject@FCbWriter@@QEAAXXZ
?AddString@FCbWriter@@QEAAXV?$TStringView@W4UTF8CHAR@FGenericPlatformTypes@@@@@Z
?AddString@FCbWriter@@QEAAXV?$TStringView@_W@@@Z
?CRCTablesSB8@FCrc@@2PAY0BAA@IA
?MemCrc32Func@FCrc@@2P6AIPEBXHI@ZEA
?GConfig@@3PEAVFConfigCacheIni@@EA
?GEngineIni@@3VFString@@A
?Singleton@IConsoleManager@@0PEAU1@EA

factoryserver-coreonline

?LexFromString@Online@UE@@YAXAEAW4EOnlineServices@12@PEB_W@Z

kernel32

GetCurrentThreadId
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSListHead

vcruntime140

memcpy
memmove
memset
__C_specific_handler
wcschr
_purecall
__current_exception
__current_exception_context
__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-convert-l1-1-0

_wcstoi64
_wtoi
wcstod

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
_cexit
_initialize_onexit_table
_crt_atexit
_execute_onexit_table
_register_onexit_function
_crt_at_quick_exit

Exports

Exports

??0FSchemaCategoryInstanceBase@Private@Online@UE@@QEAA@AEBV0123@@Z
??0FSchemaCategoryInstanceBase@Private@Online@UE@@QEAA@AEBVFName@@00AEBV?$TSharedRef@$$CBVFSchemaRegistry@Online@UE@@$00@@@Z
??0FSchemaRegistry@Online@UE@@QEAA@$$QEAV012@@Z
??0FSchemaRegistry@Online@UE@@QEAA@AEBV012@@Z
??0FSchemaRegistry@Online@UE@@QEAA@XZ
??0FSchemaVariant@Online@UE@@QEAA@$$QEAV012@@Z
??0FSchemaVariant@Online@UE@@QEAA@$$QEAVFString@@@Z
??0FSchemaVariant@Online@UE@@QEAA@AEBV012@@Z
??0FSchemaVariant@Online@UE@@QEAA@AEBVFString@@@Z
??0FSchemaVariant@Online@UE@@QEAA@N@Z
??0FSchemaVariant@Online@UE@@QEAA@PEB_W@Z
??0FSchemaVariant@Online@UE@@QEAA@XZ
??0FSchemaVariant@Online@UE@@QEAA@_J@Z
??0FSchemaVariant@Online@UE@@QEAA@_N@Z
??0FSessionSettings@Online@UE@@QEAA@$$QEAU012@@Z
??0FSessionSettings@Online@UE@@QEAA@AEBU012@@Z
??0FSessionSettings@Online@UE@@QEAA@XZ
??0FSessionSettingsUpdate@Online@UE@@QEAA@$$QEAU012@@Z
??0FSessionSettingsUpdate@Online@UE@@QEAA@AEBU012@@Z
??0FSessionSettingsUpdate@Online@UE@@QEAA@XZ
??0FSessionUpdate@Online@UE@@QEAA@$$QEAU012@@Z
??0FSessionUpdate@Online@UE@@QEAA@AEBU012@@Z
??0FSessionUpdate@Online@UE@@QEAA@XZ
??0IOnlineServices@Online@UE@@QEAA@$$QEAV012@@Z
??0IOnlineServices@Online@UE@@QEAA@AEBV012@@Z
??0IOnlineServices@Online@UE@@QEAA@XZ
??0IOnlineServicesFactory@Online@UE@@QEAA@AEBV012@@Z
??0IOnlineServicesFactory@Online@UE@@QEAA@XZ
??1FSchemaCategoryInstanceBase@Private@Online@UE@@UEAA@XZ
??1FSchemaRegistry@Online@UE@@QEAA@XZ
??1FSchemaVariant@Online@UE@@QEAA@XZ
??1FSessionSettings@Online@UE@@QEAA@XZ
??1FSessionSettingsUpdate@Online@UE@@QEAA@XZ
??1FSessionUpdate@Online@UE@@QEAA@XZ
??1IOnlineServicesFactory@Online@UE@@UEAA@XZ
??4FSchemaCategoryInstanceBase@Private@Online@UE@@QEAAAEAV0123@AEBV0123@@Z
??4FSchemaRegistry@Online@UE@@QEAAAEAV012@$$QEAV012@@Z
??4FSchemaRegistry@Online@UE@@QEAAAEAV012@AEBV012@@Z
??4FSchemaVariant@Online@UE@@QEAAAEAV012@$$QEAV012@@Z
??4FSchemaVariant@Online@UE@@QEAAAEAV012@AEBV012@@Z
??4FSessionSettings@Online@UE@@QEAAAEAU012@$$QEAU012@@Z
??4FSessionSettings@Online@UE@@QEAAAEAU012@AEBU012@@Z
??4FSessionSettingsUpdate@Online@UE@@QEAAAEAU012@$$QEAU012@@Z
??4FSessionSettingsUpdate@Online@UE@@QEAAAEAU012@AEBU012@@Z
??4FSessionUpdate@Online@UE@@QEAAAEAU012@$$QEAU012@@Z
??4FSessionUpdate@Online@UE@@QEAAAEAU012@AEBU012@@Z
??4IOnlineServices@Online@UE@@QEAAAEAV012@$$QEAV012@@Z
??4IOnlineServices@Online@UE@@QEAAAEAV012@AEBV012@@Z
??4IOnlineServicesFactory@Online@UE@@QEAAAEAV012@AEBV012@@Z
??8FSchemaVariant@Online@UE@@QEBA_NAEBV012@@Z
??8Online@UE@@YA_NAEBUFAchievementStateUpdated@01@0@Z
??8Online@UE@@YA_NAEBVFOnlineError@01@0@Z
??8Online@UE@@YA_NAEBVFOnlineError@01@_K@Z
??9FSchemaVariant@Online@UE@@QEBA_NAEBV012@@Z
??YFSessionSettings@Online@UE@@QEAAAEAU012@AEBUFSessionSettingsChanges@12@@Z
??YFSessionSettingsUpdate@Online@UE@@QEAAAEAU012@$$QEAU012@@Z
??_7FSchemaCategoryInstanceBase@Private@Online@UE@@6B@
??_7IOnlineServices@Online@UE@@6B@
??_7IOnlineServicesFactory@Online@UE@@6B@
?AccountPortal@LoginCredentialsType@Online@UE@@3VFName@@B
?AmazonAccessToken@ExternalLoginType@Online@UE@@3VFName@@B
?AppleIdToken@ExternalLoginType@Online@UE@@3VFName@@B
?Auto@LoginCredentialsType@Online@UE@@3VFName@@B
?ClearDefaultServiceOverride@FOnlineServicesRegistry@Online@UE@@QEAAXXZ
?CommitClientChanges@FSchemaCategoryInstanceBase@Private@Online@UE@@QEAA?AUResult@FSchemaCategoryInstanceCommitClientChanges@34@XZ
?CommitServiceSnapshot@FSchemaCategoryInstanceBase@Private@Online@UE@@QEAA?AUResult@FSchemaCategoryInstanceCommitServiceSnapshot@34@XZ
?CreateServices@FOnlineServicesRegistry@Online@UE@@QEAA?AV?$TSharedPtr@VIOnlineServices@Online@UE@@$00@@W4EOnlineServices@23@VFName@@@Z
?DestroyAllNamedServices@Online@UE@@YAXW4EOnlineServices@12@@Z
?DestroyAllNamedServicesInstances@FOnlineServicesRegistry@Online@UE@@QEAAXW4EOnlineServices@23@@Z
?DestroyNamedServicesInstance@FOnlineServicesRegistry@Online@UE@@QEAAXW4EOnlineServices@23@VFName@@@Z
?DestroyService@Online@UE@@YAXW4EOnlineServices@12@VFName@@@Z
?Developer@LoginCredentialsType@Online@UE@@3VFName@@B
?DeviceIdAccessToken@ExternalLoginType@Online@UE@@3VFName@@B
?DiscordAccessToken@ExternalLoginType@Online@UE@@3VFName@@B
?DisplayName@AccountAttributeData@Online@UE@@3VFName@@B
?Epic@ExternalLoginType@Online@UE@@3VFName@@B
?EpicIdToken@ExternalLoginType@Online@UE@@3VFName@@B
?ErrorCodeCategory@Errors@Online@UE@@YA_K_K@Z
?ErrorCodeSystem@Errors@Online@UE@@YA_K_K@Z
?ErrorCodeValue@Errors@Online@UE@@YA_K_K@Z
?ExchangeCode@LoginCredentialsType@Online@UE@@3VFName@@B
?ExternalAuth@LoginCredentialsType@Online@UE@@3VFName@@B
?Get@FOnlineServicesRegistry@Online@UE@@SAAEAV123@XZ
?GetAllServicesInstances@FOnlineServicesRegistry@Online@UE@@QEBAXAEAV?$TArray@V?$TSharedRef@VIOnlineServices@Online@UE@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?GetBaseDefinition@FSchemaCategoryInstanceBase@Private@Online@UE@@QEBA?AV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@XZ
?GetBoolean@FSchemaVariant@Online@UE@@QEBA_NXZ
?GetBuildUniqueId@Online@UE@@YAHXZ
?GetClientSnapshot@FSchemaCategoryInstanceBase@Private@Online@UE@@IEBAAEBV?$TMap@VFName@@VFSchemaVariant@Online@UE@@VFDefaultSetAllocator@@U?$TDefaultMapHashableKeyFuncs@VFName@@VFSchemaVariant@Online@UE@@$0A@@@@@XZ
?GetDefinition@FSchemaRegistry@Online@UE@@QEBA?AV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@AEBVFName@@@Z
?GetDefinition@FSchemaRegistry@Online@UE@@QEBA?AV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@_J@Z
?GetDerivedDefinition@FSchemaCategoryInstanceBase@Private@Online@UE@@QEBA?AV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@XZ
?GetDouble@FSchemaVariant@Online@UE@@QEBANXZ
?GetInt64@FSchemaVariant@Online@UE@@QEBA_JXZ
?GetNamedServicesInstance@FOnlineServicesRegistry@Online@UE@@QEAA?AV?$TSharedPtr@VIOnlineServices@Online@UE@@$00@@W4EOnlineServices@23@VFName@@@Z
?GetSerializationSchema@FSchemaCategoryInstanceBase@Private@Online@UE@@AEBA_NPEAPEBUFSchemaDefinition@34@PEAPEBUFSchemaCategoryDefinition@34@@Z
?GetServices@Online@UE@@YA?AV?$TSharedPtr@VIOnlineServices@Online@UE@@$00@@W4EOnlineServices@12@VFName@@@Z
?GetString@FSchemaVariant@Online@UE@@QEBAAEBVFString@@XZ
?GetType@FSchemaVariant@Online@UE@@QEBA?AW4ESchemaAttributeType@23@XZ
?GogSessionTicket@ExternalLoginType@Online@UE@@3VFName@@B
?GoogleIdToken@ExternalLoginType@Online@UE@@3VFName@@B
?InitializeSchemaDefinition@FSchemaCategoryInstanceBase@Private@Online@UE@@AEBA_NAEBV?$TSharedRef@$$CBUFSchemaDefinition@Online@UE@@$00@@PEBUFSchemaDefinition@34@AEBVFName@@PEAV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@PEAPEBUFSchemaCategoryDefinition@34@@Z
?InitializeSchemaDefinition@FSchemaCategoryInstanceBase@Private@Online@UE@@AEBA_NAEBVFName@@PEBUFSchemaDefinition@34@0PEAV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@PEAPEBUFSchemaCategoryDefinition@34@@Z
?InitializeSchemaDefinition@FSchemaCategoryInstanceBase@Private@Online@UE@@AEBA_N_JPEBUFSchemaDefinition@34@AEBVFName@@PEAV?$TSharedPtr@$$CBUFSchemaDefinition@Online@UE@@$00@@PEAPEBUFSchemaCategoryDefinition@34@@Z
?IsLoaded@FOnlineServicesRegistry@Online@UE@@QEBA_NW4EOnlineServices@23@VFName@@@Z
?IsLoaded@Online@UE@@YA_NW4EOnlineServices@12@VFName@@@Z
?IsSchemaChildOf@FSchemaRegistry@Online@UE@@QEBA_NAEBVFName@@0@Z
?IsValid@FSchemaCategoryInstanceBase@Private@Online@UE@@QEBA_NXZ
?ItchioJwt@ExternalLoginType@Online@UE@@3VFName@@B
?ItchioKey@ExternalLoginType@Online@UE@@3VFName@@B
?LexFromString@Online@UE@@YAXAEAVFSchemaVariant@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EExternalAuthTokenMethod@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ELobbyJoinPolicy@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ELobbyMemberLeaveReason@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ELoginStatus@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EOfferType@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EOnlineServicesConnectionStatus@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EPrivilegeResults@12@AEBVFString@@@Z
?LexFromString@Online@UE@@YAXAEAW4ERemoteAuthTicketAudience@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESchemaAttributeComparisonOp@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESchemaAttributeFlags@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESchemaAttributeType@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESchemaAttributeVisibility@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESchemaServiceAttributeFlags@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESchemaServiceAttributeSupportedTypeFlags@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4ESessionJoinPolicy@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EUILobbyJoinRequestedSource@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EUISessionJoinRequestedSource@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EUserPresenceGameStatus@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EUserPresenceJoinability@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EUserPresenceStatus@12@PEB_W@Z
?LexFromString@Online@UE@@YAXAEAW4EUserPrivileges@12@PEB_W@Z
?LexToString@Online@UE@@YA?AVFString@@W4EPrivilegeResults@12@@Z
?LexToString@Online@UE@@YA?BVFString@@AEBV?$FLexToStringAdaptor@VFSchemaVariant@Online@UE@@@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EExternalAuthTokenMethod@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ELobbyJoinPolicy@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ELobbyMemberLeaveReason@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ELoginStatus@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EOfferType@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EOnlineServicesConnectionStatus@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ERemoteAuthTicketAudience@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESchemaAttributeComparisonOp@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESchemaAttributeFlags@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESchemaAttributeType@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESchemaAttributeVisibility@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESchemaServiceAttributeFlags@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESchemaServiceAttributeSupportedTypeFlags@12@@Z
?LexToString@Online@UE@@YAPEB_WW4ESessionJoinPolicy@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EUILobbyJoinRequestedSource@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EUISessionJoinRequestedSource@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EUserPresenceGameStatus@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EUserPresenceJoinability@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EUserPresenceStatus@12@@Z
?LexToString@Online@UE@@YAPEB_WW4EUserPrivileges@12@@Z
?LogOnlineServices@@3UFLogCategoryLogOnlineServices@@A
?NintendoIdToken@ExternalLoginType@Online@UE@@3VFName@@B
?NintendoNsaIdToken@ExternalLoginType@Online@UE@@3VFName@@B
?OculusUserIdNonce@ExternalLoginType@Online@UE@@3VFName@@B
?OnOnlineServicesCreated@Online@UE@@3V?$TMulticastDelegate@$$A6AXV?$TSharedRef@VIOnlineServices@Online@UE@@$00@@@ZUFDefaultDelegateUserPolicy@@@@A
?OpenIdAccessToken@ExternalLoginType@Online@UE@@3VFName@@B
?ParseConfig@FSchemaRegistry@Online@UE@@QEAA_NAEBUFSchemaRegistryDescriptorConfig@23@@Z
?Password@LoginCredentialsType@Online@UE@@3VFName@@B
?PersistentAuth@LoginCredentialsType@Online@UE@@3VFName@@B
?PrepareClientChanges@FSchemaCategoryInstanceBase@Private@Online@UE@@QEBA?AV?$TOnlineResult@UFSchemaCategoryInstancePrepareClientChanges@Online@UE@@@34@$$QEAUParams@FSchemaCategoryInstancePrepareClientChanges@34@@Z
?PrepareServiceSnapshot@FSchemaCategoryInstanceBase@Private@Online@UE@@QEBA?AV?$TOnlineResult@UFSchemaCategoryInstancePrepareServiceSnapshot@Online@UE@@@34@$$QEAUParams@FSchemaCategoryInstancePrepareServiceSnapshot@34@@Z
?PsnAuthCode@ExternalServerAuthTicketType@Online@UE@@3VFName@@B
?PsnIdToken@ExternalLoginType@Online@UE@@3VFName@@B
?RefreshToken@LoginCredentialsType@Online@UE@@3VFName@@B
?RegisterServicesFactory@FOnlineServicesRegistry@Online@UE@@QEAAXW4EOnlineServices@23@$$QEAV?$TUniquePtr@VIOnlineServicesFactory@Online@UE@@U?$TDefaultDelete@VIOnlineServicesFactory@Online@UE@@@@@@H@Z
?ResetPreparedChanges@FSchemaCategoryInstanceBase@Private@Online@UE@@AEBAXXZ
?SerializeForLog@Online@UE@@YAXAEAVFCbWriter@@AEBVFOnlineError@12@@Z
?Set@FSchemaVariant@Online@UE@@QEAAX$$QEAVFString@@@Z
?Set@FSchemaVariant@Online@UE@@QEAAXAEBVFString@@@Z
?Set@FSchemaVariant@Online@UE@@QEAAXN@Z
?Set@FSchemaVariant@Online@UE@@QEAAXPEB_W@Z
?Set@FSchemaVariant@Online@UE@@QEAAX_J@Z
?Set@FSchemaVariant@Online@UE@@QEAAX_N@Z
?SetDefaultServiceOverride@FOnlineServicesRegistry@Online@UE@@QEAAXW4EOnlineServices@23@@Z
?SortLobbies@Online@UE@@YAXAEBV?$TArray@UFFindLobbySearchFilter@Online@UE@@V?$TSizedDefaultAllocator@$0CA@@@@@AEAV?$TArray@V?$TSharedRef@$$CBUFLobby@Online@UE@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?SteamAppTicket@ExternalLoginType@Online@UE@@3VFName@@B
?TearDown@FOnlineServicesRegistry@Online@UE@@SAXXZ
?ToLogString@FSchemaVariant@Online@UE@@QEBA?AVFString@@XZ
?ToLogString@Online@UE@@YA?AVFString@@AEBUFAchievementDefinition@12@@Z
?ToLogString@Online@UE@@YA?AVFString@@AEBUFAchievementStatDefinition@12@@Z
?ToLogString@Online@UE@@YA?AVFString@@AEBUFAchievementState@12@@Z
?ToLogString@Online@UE@@YA?BVFString@@AEBVISession@12@@Z
?ToLogString@Online@UE@@YA?BVFString@@AEBVISessionInvite@12@@Z
?ToString@ErrorCode@Errors@Online@UE@@YA?AVFString@@_K@Z
?UnregisterServicesFactory@FOnlineServicesRegistry@Online@UE@@QEAAXW4EOnlineServices@23@H@Z
?UplayAccessToken@ExternalLoginType@Online@UE@@3VFName@@B
?VerifyBaseAttributeData@FSchemaCategoryInstanceBase@Private@Online@UE@@QEAA_NAEBVFName@@AEBVFSchemaVariant@34@AEAV5@AEAW4ESchemaServiceAttributeFlags@34@@Z
?XblXstsToken@ExternalLoginType@Online@UE@@3VFName@@B
?XblXstsToken@ExternalServerAuthTicketType@Online@UE@@3VFName@@B
InitializeModule

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4917567849d98321dbf580628df39ee6

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

59:dd:d2:bf:a6:72:e1:01:5a:f0:0f:f1Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

20:38:fa:e2:eb:08:48:22:f5:ba:1e:d9:dc:09:c2:2a:2d:08:0f:ba:91:9d:2e:c6:ff:97:a3:7d:67:0d:51:d5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

factoryserver-core

factoryserver-coreonline

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 195KB - Virtual size: 194KB

.uedbg Size: 6KB - Virtual size: 6KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 1024B - Virtual size: 768B

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

59:dd:d2:bf:a6:72:e1:01:5a:f0:0f:f1
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

20:38:fa:e2:eb:08:48:22:f5:ba:1e:d9:dc:09:c2:2a:2d:08:0f:ba:91:9d:2e:c6:ff:97:a3:7d:67:0d:51:d5
Signer

.text
Size: 195KB - Virtual size: 194KB

.uedbg
Size: 6KB - Virtual size: 6KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 1024B - Virtual size: 768B