| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jun-09 23:12:01 |
| Detected languages |
English - United States
|
| Debug artifacts |
vgc.pdb
|
| CompanyName | Riot Games, Inc. |
| FileDescription | Vanguard user-mode service. |
| FileVersion | 1.90.0.0 |
| InternalName | vgc.exe |
| LegalCopyright | Copyright (C) 2021 |
| OriginalFilename | vgc.exe |
| ProductName | Vanguard Client |
| ProductVersion | 1.90.0.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 12/67 (Scanned on 2026-06-14 05:51:28) |
APEX:
Malicious
Bkav: W32.Malware.CF0EF26E CrowdStrike: win/malicious_confidence_90% (W) Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Malwarebytes: Crypt.Trojan.MSIL.DDS Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Sophos: Mal/Generic-S Trapmine: malicious.moderate.ml.score TrellixENS: Artemis!BC4E7656AB85 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Jun-09 23:12:01 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x139000 |
| SizeOfInitializedData | 0x51400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000123D14 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x191000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor OpenProcessToken RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetServiceStatus StartServiceCtrlDispatcherW |
|---|---|
| KERNEL32.dll |
CloseHandle
CompareStringW ConnectNamedPipe CreateEventW CreateFileA CreateFileW CreateNamedPipeA CreateThread DeleteCriticalSection DeleteFileA DisconnectNamedPipe EncodePointer EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathA HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile |
| USERENV.dll |
ExpandEnvironmentStringsForUserW
|
| bcrypt.dll |
BCryptCloseAlgorithmProvider
BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.90.0.0 |
| ProductVersion | 1.90.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Riot Games, Inc. |
| FileDescription | Vanguard user-mode service. |
| FileVersion (#2) | 1.90.0.0 |
| InternalName | vgc.exe |
| LegalCopyright | Copyright (C) 2021 |
| OriginalFilename | vgc.exe |
| ProductName | Vanguard Client |
| ProductVersion (#2) | 1.90.0.0 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-09 23:12:01 |
| Version | 0.0 |
| SizeofData | 32 |
| AddressOfRawData | 0x14308c |
| PointerToRawData | 0x14248c |
| Referenced File | vgc.pdb |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140146040 |
No comments yet.