Riot Vanguard[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

Riot Vanguard.rar
Size

24.7MB
MD5

cce589dc2f1dd11e2ee2dd997eca1ee7
SHA1

8939d90f678ab7175eab9aa4238f0ee7c22b3b39
SHA256

a42a8ff1902cf63d0a087335b3a04dfc349471fca551b948a834e8049efa95af
SHA512

33c4a62998589ee223debb49f7fb61ac57ed95c122f924ef044042df68f63541aa9c135dbbd69a85379a50c3a350586fb5b6e92feec5c383a5acd2665e35d5e0
SSDEEP

786432:Qx3uurjux9NA4Kd/k839SV64ZjcyHgdrD77b:fBx9HKdZN4cwgVH

Score

1^/10

Malware Config

Signatures

Files

Riot Vanguard.rar
.rar
Riot Vanguard/Logs/vgc_32328_2024-05-15_14-48-30.log
Riot Vanguard/installer.exe
.exe windows:6 windows x64 arch:x64

68b837afc10da8696e1b0794f0bfa282

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-12-2022 00:00

Not After

03-12-2024 23:59

Subject

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:4c:2f:92:69:65:80:79:73:4b:1f:2d:c3:f0:e0:cf:4b:0a:8a:02:73:22:b4:57:94:68:06:7b:fe:35:e3:d0
Signer

Actual PE Digest

6b:4c:2f:92:69:65:80:79:73:4b:1f:2d:c3:f0:e0:cf:4b:0a:8a:02:73:22:b4:57:94:68:06:7b:fe:35:e3:d0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

https://imgur.com/a/PiWvsB0

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

shlwapi

PathRemoveFileSpecW

kernel32

ExitThread
FreeLibraryAndExitThread
Sleep
GetCurrentProcessId
CreateThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
RtlUnwind
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcess
GetExitCodeProcess
CloseHandle
WaitForSingleObject
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetLastError
GetModuleHandleExW
LoadLibraryW
ConvertThreadToFiber
ConvertFiberToThread
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
CreateFiber
DeleteFiber
SwitchToFiber
FormatMessageW
ReadConsoleA
SetConsoleMode
GetEnvironmentVariableW
VerifyVersionInfoA
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
WaitForMultipleObjects
PeekNamedPipe
ExpandEnvironmentStringsA
WaitForSingleObjectEx
GetTickCount
QueryPerformanceFrequency
SleepEx
WriteConsoleW
CreateFileW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
SetLastError
GetCurrentDirectoryW
GetFullPathNameW
GetFileAttributesExW
GetCPInfo
SetFilePointerEx
GetFileSizeEx
SetStdHandle
MultiByteToWideChar
FormatMessageA
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
SetEndOfFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetStdHandle
WriteFile
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW

advapi32

CryptDecrypt
RegQueryValueExW
OpenProcessToken
GetTokenInformation
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
ControlService
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
OpenSCManagerW
QueryServiceStatus
CloseServiceHandle
OpenServiceW

shell32

CommandLineToArgvW
ShellExecuteExW
ShellExecuteW

vgrl

ord1337

ws2_32

getaddrinfo
WSAIoctl
setsockopt
ntohs
recvfrom
sendto
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
listen
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
ioctlsocket
gethostname
getnameinfo
shutdown
send
accept
freeaddrinfo

wldap32

ord41
ord50
ord60
ord211
ord46
ord143
ord26
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord22

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

wtsapi32

WTSSendMessageA

gdiplus

GdiplusStartup

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Riot Vanguard/log-uploader.exe
.exe windows:6 windows x64 arch:x64

47a8bb6048dc7de6fccacc5f57ab742b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-12-2022 00:00

Not After

03-12-2024 23:59

Subject

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:ea:a6:2c:f5:1f:32:3d:2f:38:d7:7f:f3:74:24:72:6e:99:32:ce:4c:59:47:bc:17:fc:85:eb:b9:40:fe:87
Signer

Actual PE Digest

33:ea:a6:2c:f5:1f:32:3d:2f:38:d7:7f:f3:74:24:72:6e:99:32:ce:4c:59:47:bc:17:fc:85:eb:b9:40:fe:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\vanguard-client\rollback-1.14.8.x\x64\Public\log-uploader.pdb

Imports

ws2_32

ioctlsocket
WSACleanup
WSAGetLastError
shutdown
getnameinfo
gethostname
WSAStartup
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket

wldap32

ord46
ord32
ord211
ord301
ord200
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50
ord60

crypt32

CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore

comctl32

ImageList_GetIconSize

kernel32

RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
RaiseException
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
VerSetConditionMask
VerifyVersionInfoW
SetLastError
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
SleepEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
CloseHandle
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
FormatMessageA
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
GetEnvironmentVariableW
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
FileTimeToSystemTime
TlsFree
GetModuleHandleExW
FormatMessageW
WriteFile
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
GetCurrentProcess
LCMapStringEx
DecodePointer
EncodePointer
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetFileInformationByHandleEx
AreFileApisANSI
IsDebuggerPresent
SetConsoleCtrlHandler
ExitProcess
GetModuleFileNameW
GetConsoleOutputCP
HeapAlloc
HeapFree
GetFileSizeEx
FlushFileBuffers
CompareStringW
LCMapStringW
GetLocaleInfoW
GetUserDefaultLCID
IsValidLocale
EnumSystemLocalesW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
TlsSetValue
RtlUnwind
IsProcessorFeaturePresent
TerminateProcess
GetExitCodeThread
LocalFree
GetCurrentDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointerEx

user32

GetUserObjectInformationW
GetProcessWindowStation
GetWindowRect
ClientToScreen
FrameRect
GetSysColor
GetWindowDC
DestroyWindow
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
SetWindowTextW
GetWindowLongPtrW
LoadStringW
OpenClipboard
DestroyIcon
CloseClipboard
EmptyClipboard
RegisterClassW
MoveWindow
LoadIconW
LoadCursorW
MessageBoxW
GetDlgItem
DrawIconEx
PostQuitMessage
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetClientRect
BeginPaint
EndPaint
FillRect
TrackMouseEvent
DrawTextW
DrawEdge
InvalidateRect
SendMessageW
ShowWindow
DispatchMessageW
PeekMessageW
TranslateMessage
UpdateWindow
GetDC
GetSystemMetrics
LoadImageW
ReleaseDC
SetClipboardData
SetWindowLongW

gdi32

TextOutW
SetTextColor
SelectObject
CreateSolidBrush
GetDeviceCaps
GetObjectW
CreateFontIndirectW
SetBkColor
GetStockObject
MoveToEx
CreatePen
LineTo
SetBkMode
DeleteObject
CreateFontW

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 695KB - Virtual size: 695KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.toir
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
Riot Vanguard/vgc.exe
.exe windows:6 windows x64 arch:x64

f305d180f45fc7f8e3ac15288fdc4339

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-12-2022 00:00

Not After

03-12-2024 23:59

Subject

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:af:c1:a5:2d:0c:77:98:f9:a5:38:01:2f:d0:5d:68:76:b2:7e:27:e6:d7:90:d7:db:b7:94:9b:dc:a0:42:ba
Signer

Actual PE Digest

70:af:c1:a5:2d:0c:77:98:f9:a5:38:01:2f:d0:5d:68:76:b2:7e:27:e6:d7:90:d7:db:b7:94:9b:dc:a0:42:ba

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

https://imgur.com/a/PiWvsB0

Imports

gdiplus

GdiplusStartup

shell32

CommandLineToArgvW

wtsapi32

WTSSendMessageA
WTSSendMessageW

shlwapi

PathAppendW

kernel32

ConnectNamedPipe
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

CryptDecrypt

ole32

CoInitializeEx

wintrust

WinVerifyTrust

ws2_32

listen

wldap32

ord27

crypt32

CryptQueryObject

ntdll

RtlDeleteFunctionTable

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

iphlpapi

GetIpNetTable

userenv

GetAllUsersProfileDirectoryW

Sections

.text
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 933KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stub1
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stub0
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.toir
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.stub2
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.stub3
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Riot Vanguard/vgc.ico
Riot Vanguard/vgk.sys
.sys windows:10 windows x64 arch:x64

2cbd4e57df9b1ed44139b4dc7cc7c515

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-12-2022 00:00

Not After

03-12-2024 23:59

Subject

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:69:9d:42:c9:76:75:b5:08:82:00:00:00:00:00:69
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-01-2024 20:09

Not After

10-01-2025 20:09

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-10-2014 20:31

Not After

15-10-2029 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:dc:5b:c3:cf:57:7d:6d:91:07:1c:06:99:db:f8:b9:49:3f:fa:7e:71:94:94:8f:4b:c6:e6:b9:58:55:56:bb
Signer

Actual PE Digest

77:dc:5b:c3:cf:57:7d:6d:91:07:1c:06:99:db:f8:b9:49:3f:fa:7e:71:94:94:8f:4b:c6:e6:b9:58:55:56:bb

Digest Algorithm

sha256

PE Digest Matches

true

77:dc:5b:c3:cf:57:7d:6d:91:07:1c:06:99:db:f8:b9:49:3f:fa:7e:71:94:94:8f:4b:c6:e6:b9:58:55:56:bb
Signer

Actual PE Digest

77:dc:5b:c3:cf:57:7d:6d:91:07:1c:06:99:db:f8:b9:49:3f:fa:7e:71:94:94:8f:4b:c6:e6:b9:58:55:56:bb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

https://imgur.com/a/PiWvsB0

Imports

ntoskrnl.exe

ZwClose
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExAllocatePoolWithTag
KeLowerIrql
KfRaiseIrql
KeInitializeDpc
KeInitializeTimer
KeSetTimer
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoFreeMdl
IoAllocateWorkItem
IoQueueWorkItem
IoInitializeWorkItem
RtlDuplicateUnicodeString
ObfDereferenceObject
KeBugCheckEx
_stricmp
__C_specific_handler
KeIpiGenericCall
ExFreePoolWithTag
ProbeForRead
IoGetCurrentProcess
wcscpy_s
RtlInitUnicodeString
RtlTimeToTimeFields
KeAreAllApcsDisabled
ExSystemTimeToLocalTime
ZwWriteFile
IoCreateFileEx
ZwFlushBuffersFile
swprintf_s
vswprintf_s
_vsnwprintf
KeInitializeApc
KeInsertQueueApc
wcscat_s
ZwReadFile
ZwQuerySystemInformation
IoGetStackLimits
strchr
RtlPrefixUnicodeString
RtlMultiByteToUnicodeN
MmHighestUserAddress
ObReferenceObjectByHandle
IoFileObjectType
strnlen

cng.sys

BCryptDestroyHash
BCryptCloseAlgorithmProvider

Exports

Exports

Egg

Sections

.text
Size: 446KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_ENTROPY
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.NT
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stub0
Size: 411KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 19.5MB - Virtual size: 19.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Riot Vanguard/vgrl.dll
.dll windows:6 windows x64 arch:x64

25e771750b46c59ebd6e1832c28730de

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-12-2022 00:00

Not After

03-12-2024 23:59

Subject

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fa:ac:48:2d:e0:83:6c:7c:79:57:e2:65:a7:b2:93:3b:6d:9d:db:f3:9e:0e:c9:1c:ec:7c:51:33:42:e5:be:13
Signer

Actual PE Digest

fa:ac:48:2d:e0:83:6c:7c:79:57:e2:65:a7:b2:93:3b:6d:9d:db:f3:9e:0e:c9:1c:ec:7c:51:33:42:e5:be:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

https://imgur.com/a/PiWvsB0

Imports

kernel32

CreateProcessW
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stub0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.stub1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Riot Vanguard/vgtray.exe
.exe windows:6 windows x64 arch:x64

2879987ac6fb0ed9ba21d06903f2a671

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-12-2022 00:00

Not After

03-12-2024 23:59

Subject

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:8a:cd:15:6b:55:95:bb:98:97:bf:b0:b2:0e:dd:2b:14:1d:34:2b:76:72:4d:8d:eb:20:92:33:d5:c2:fe:ae
Signer

Actual PE Digest

e5:8a:cd:15:6b:55:95:bb:98:97:bf:b0:b2:0e:dd:2b:14:1d:34:2b:76:72:4d:8d:eb:20:92:33:d5:c2:fe:ae

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

https://imgur.com/a/PiWvsB0

Imports

ws2_32

ioctlsocket
WSACleanup
WSAGetLastError
shutdown
getnameinfo
gethostname
WSAStartup
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket

wldap32

ord46
ord32
ord211
ord301
ord200
ord30
ord79
ord35
ord33
ord143
ord27
ord26
ord22
ord41
ord50
ord60

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

shlwapi

PathFindExtensionW

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ExitThread
GetDriveTypeW
CreateFileW
FreeLibraryAndExitThread
SetFilePointerEx
SetConsoleCtrlHandler
GetModuleFileNameW
GetConsoleOutputCP
GetFileInformationByHandle
HeapFree
RtlPcToFileHeader
RtlUnwindEx
SetLastError
CreateProcessW
CloseHandle
GetEnvironmentVariableW
Sleep
ExitProcess
CreateThread
K32GetMappedFileNameW
GetCurrentProcess
SetEvent
WaitForSingleObjectEx
GetLastError
CreateEventW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
GetProcAddress
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
MultiByteToWideChar
FormatMessageW
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
LoadLibraryExW
HeapAlloc
GetFileSizeEx
FlushFileBuffers
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetFileAttributesExW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
HeapSize
WriteConsoleW
FormatMessageA
RtlUnwind
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
RaiseException

user32

TrackPopupMenuEx
GetSystemMetrics
SetForegroundWindow
GetSubMenu
LoadMenuW
GetProcessWindowStation
PostQuitMessage
DestroyMenu
DestroyWindow
CreateWindowExW
RegisterClassExW
LoadIconW
DispatchMessageW
TranslateMessage
GetMessageW
GetUserObjectInformationW
MessageBoxW
GetCursorPos
DefWindowProcW

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
NotifyServiceStatusChangeW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW

shell32

SHGetKnownFolderPath
Shell_NotifyIconW
ShellExecuteW

ole32

CoTaskMemFree

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 680KB - Virtual size: 679KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68b837afc10da8696e1b0794f0bfa282

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

6b:4c:2f:92:69:65:80:79:73:4b:1f:2d:c3:f0:e0:cf:4b:0a:8a:02:73:22:b4:57:94:68:06:7b:fe:35:e3:d0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

shlwapi

kernel32

user32

advapi32

shell32

vgrl

ws2_32

wldap32

crypt32

wtsapi32

gdiplus

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 673KB - Virtual size: 673KB

.data Size: 27KB - Virtual size: 48KB

.pdata Size: 85KB - Virtual size: 85KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 27KB - Virtual size: 26KB

47a8bb6048dc7de6fccacc5f57ab742b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

33:ea:a6:2c:f5:1f:32:3d:2f:38:d7:7f:f3:74:24:72:6e:99:32:ce:4c:59:47:bc:17:fc:85:eb:b9:40:fe:87Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

crypt32

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6b:4c:2f:92:69:65:80:79:73:4b:1f:2d:c3:f0:e0:cf:4b:0a:8a:02:73:22:b4:57:94:68:06:7b:fe:35:e3:d0
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 673KB - Virtual size: 673KB

.data
Size: 27KB - Virtual size: 48KB

.pdata
Size: 85KB - Virtual size: 85KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 27KB - Virtual size: 26KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

33:ea:a6:2c:f5:1f:32:3d:2f:38:d7:7f:f3:74:24:72:6e:99:32:ce:4c:59:47:bc:17:fc:85:eb:b9:40:fe:87
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 695KB - Virtual size: 695KB

.data
Size: 30KB - Virtual size: 52KB

.pdata
Size: 89KB - Virtual size: 88KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 28KB - Virtual size: 27KB

.toir
Size: 512B - Virtual size: 4KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

70:af:c1:a5:2d:0c:77:98:f9:a5:38:01:2f:d0:5d:68:76:b2:7e:27:e6:d7:90:d7:db:b7:94:9b:dc:a0:42:ba
Signer

.text
Size: - Virtual size: 3.2MB

.rdata
Size: - Virtual size: 933KB

.data
Size: - Virtual size: 93KB

.pdata
Size: - Virtual size: 119KB

_RDATA
Size: - Virtual size: 244B

.stub1
Size: - Virtual size: 27KB

.stub0
Size: - Virtual size: 35KB

.toir
Size: - Virtual size: 4KB

.stub2
Size: - Virtual size: 5.8MB

.stub3
Size: 9.1MB - Virtual size: 9.1MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 28KB - Virtual size: 27KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:d1:d0:38:01:51:29:a4:3d:a0:ae:e2:11:85:9c:8e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate