Overview

overview

8

Static

static

1

parsec-windows.exe

windows7-x64

3

parsec-windows.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2023, 23:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    parsec-windows.exe

  • Size

    2.7MB

  • MD5

    b49af1859c41d9178c4af8b330d64741

  • SHA1

    1272d1cd56010a813e05bcb32d8cf824e8a5e725

  • SHA256

    ae654731f8e85ec41a77edbfad7ec0064497421803fbc5105ca8a935af57fd6e

  • SHA512

    238add2b5db89886e31e281fa633ac4657580c853b5f6750a6e6816ffb85551466abbe7589fe60e19c0fe57989258c99a658331a4e039b48a991a5d2f8cc66cc

  • SSDEEP

    49152:MmRtVNwyndBmOrH+e/xsQjhtmZZcoANnuR+pAfkdE2WX8zPmK:3vhQ1st7oMpA92fmK

Score
8/10
discoveryevasionpersistence

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 1 TTPs 4 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 21 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\service-kill-parsec.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" control Parsec 200
        3⤵
        • Launches sc.exe
        PID:4228
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\devcon-remove.vbs" "C:\Program Files\Parsec\vusb\"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Program Files\Parsec\vusb\devcon.exe
        "C:\Program Files\Parsec\vusb\devcon.exe" remove Root\Parsec\VUSBA
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4428
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\vdd-remove.vbs" "C:\Program Files\Parsec\vdd\"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Program Files\Parsec\vdd\devcon.exe
        "C:\Program Files\Parsec\vdd\devcon.exe" remove Root\Parsec\VDA
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4724
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\service-remove.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" stop Parsec
        3⤵
        • Launches sc.exe
        PID:3784
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" delete Parsec
        3⤵
        • Launches sc.exe
        PID:3644
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\firewall-remove.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4836
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name=Parsec
        3⤵
        • Modifies Windows Firewall
        PID:4944
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name=parsec.exe
        3⤵
        • Modifies Windows Firewall
        PID:1436
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name=parsecd.exe
        3⤵
        • Modifies Windows Firewall
        PID:2872
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\legacy-cleanup.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn ParsecTeams /f
        3⤵
          PID:1520
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\service-install.vbs" "C:\Program Files\Parsec\pservice.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create Parsec binPath= "\"C:\Program Files\Parsec\pservice.exe\"" start= auto type= interact type= own
          3⤵
          • Launches sc.exe
          PID:2692
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start Parsec
          3⤵
          • Launches sc.exe
          PID:1580
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\firewall-add.vbs" "C:\Program Files\Parsec\parsecd.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name=Parsec dir=in action=allow program="C:\Program Files\Parsec\parsecd.exe" enable=yes profile=public,private,domain
          3⤵
          • Modifies Windows Firewall
          PID:3004
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\devcon-install.vbs" "C:\Program Files\Parsec\vusb\"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Program Files\Parsec\vusb\devcon.exe
          "C:\Program Files\Parsec\vusb\devcon.exe" install "C:\Program Files\Parsec\vusb\parsecvusba.inf" Root\Parsec\VUSBA
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3996
      • C:\Program Files\Parsec\parsecd.exe
        "C:\Program Files\Parsec\parsecd.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:2028
    • C:\Program Files\Parsec\pservice.exe
      "C:\Program Files\Parsec\pservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2564
      • C:\Program Files\Parsec\parsecd.exe
        "C:\Program Files\Parsec\parsecd.exe" SERVICE_LAUNCHED_V6
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies data under HKEY_USERS
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3724
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9acfa4c0-907c-9a4e-9cff-21655bd74ad4}\parsecvusba.inf" "9" "4419fa153" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\parsec\vusb"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4560
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce884b7ae9cce:parsecvusba_Device:0.1.1.0:root\parsec\vusba," "4419fa153" "0000000000000148"
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5044
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x374 0x490
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4156

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Parsec\parsecd.exe
            Filesize

            451KB

            MD5

            adf970bb295346b0a6c53f88a1df50e4

            SHA1

            c3025efc68b330d0f95e9fed17f243f289e77636

            SHA256

            af30926b8bd58a9871d2c987d6c1647caf28f776315a6a82b1b12d04511f1efc

            SHA512

            4ae4207e9585a53667ee06cfca7dffab11668bde2d6bfbb62b664f0686ec5ea29c43eefff333672e45ba54602721c171f2524fc25a4f3c78ebfd83d03dad9951

            Download Submit

          • C:\Program Files\Parsec\parsecd.exe
            Filesize

            451KB

            MD5

            adf970bb295346b0a6c53f88a1df50e4

            SHA1

            c3025efc68b330d0f95e9fed17f243f289e77636

            SHA256

            af30926b8bd58a9871d2c987d6c1647caf28f776315a6a82b1b12d04511f1efc

            SHA512

            4ae4207e9585a53667ee06cfca7dffab11668bde2d6bfbb62b664f0686ec5ea29c43eefff333672e45ba54602721c171f2524fc25a4f3c78ebfd83d03dad9951

            Download Submit

          • C:\Program Files\Parsec\parsecd.exe
            Filesize

            451KB

            MD5

            adf970bb295346b0a6c53f88a1df50e4

            SHA1

            c3025efc68b330d0f95e9fed17f243f289e77636

            SHA256

            af30926b8bd58a9871d2c987d6c1647caf28f776315a6a82b1b12d04511f1efc

            SHA512

            4ae4207e9585a53667ee06cfca7dffab11668bde2d6bfbb62b664f0686ec5ea29c43eefff333672e45ba54602721c171f2524fc25a4f3c78ebfd83d03dad9951

            Download Submit

          • C:\Program Files\Parsec\parsecd.exe
            Filesize

            451KB

            MD5

            adf970bb295346b0a6c53f88a1df50e4

            SHA1

            c3025efc68b330d0f95e9fed17f243f289e77636

            SHA256

            af30926b8bd58a9871d2c987d6c1647caf28f776315a6a82b1b12d04511f1efc

            SHA512

            4ae4207e9585a53667ee06cfca7dffab11668bde2d6bfbb62b664f0686ec5ea29c43eefff333672e45ba54602721c171f2524fc25a4f3c78ebfd83d03dad9951

            Download Submit

          • C:\Program Files\Parsec\pservice.exe
            Filesize

            414KB

            MD5

            4c828bfc7282b9faac68dcffa04748ec

            SHA1

            5f7cc414c79ec029accc1974d77ac1121ab065a9

            SHA256

            858395062d04854410abb29ba7e89b9c9d3a5afcb19713c76a3131057f9af0e2

            SHA512

            269ef798b53b3f75c951c7ed1af4377c8e6a319db79e26f60ee36419c7147ed0208ecd08862d701e3990d270c007f12328ff181125082bb9059aad586abd5377

            Download Submit

          • C:\Program Files\Parsec\pservice.exe
            Filesize

            414KB

            MD5

            4c828bfc7282b9faac68dcffa04748ec

            SHA1

            5f7cc414c79ec029accc1974d77ac1121ab065a9

            SHA256

            858395062d04854410abb29ba7e89b9c9d3a5afcb19713c76a3131057f9af0e2

            SHA512

            269ef798b53b3f75c951c7ed1af4377c8e6a319db79e26f60ee36419c7147ed0208ecd08862d701e3990d270c007f12328ff181125082bb9059aad586abd5377

            Download Submit

          • C:\Program Files\Parsec\skel\appdata.json
            Filesize

            155B

            MD5

            402a61c961006a551518f9174c4bdefc

            SHA1

            2ce0fb21a2a7aa057d4bcc934e9a2d1e95211f70

            SHA256

            6a4b62597d69a1d490fdbced9d0076551ce512b3d29ae018df4e9835f739aedb

            SHA512

            1ad72563de25d5c04d7d3267287d20a57f89a41d07b984fabb85f2b0c68ca2be8f8aa36d5d52b22819fe110a7fc99e961a53ebaa0d18296142d3d1b9f354f99c

            Download Submit

          • C:\Program Files\Parsec\skel\parsecd-150-86h.dll
            Filesize

            3.2MB

            MD5

            864f36082ae99b72597e64fdd3420250

            SHA1

            73fa06def6cb66271778edc46b95e13f1149e843

            SHA256

            917e9c68ac5a6d9c22c3ce20382679caed91d81cd51a4545a7515331db0cd2b8

            SHA512

            9cc2b57196deb61f9390b171e9ca803afe814dcb424c149d5e8675cdd4d2f12003aa3fcb27a61e8d9c5268fb3150bac9cc34b8306ccd7c57c9fe32b71a43a220

            Download Submit

          • C:\Program Files\Parsec\vdd\devcon.exe
            Filesize

            80KB

            MD5

            a9b2b49cc4457ad9d63b10c4fd6c9748

            SHA1

            358179dc6acaca3101c3b6f8af4d471267576d63

            SHA256

            270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

            SHA512

            8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

            Download Submit

          • C:\Program Files\Parsec\vdd\devcon.exe
            Filesize

            80KB

            MD5

            a9b2b49cc4457ad9d63b10c4fd6c9748

            SHA1

            358179dc6acaca3101c3b6f8af4d471267576d63

            SHA256

            270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

            SHA512

            8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

            Download Submit

          • C:\Program Files\Parsec\vusb\devcon.exe
            Filesize

            80KB

            MD5

            a9b2b49cc4457ad9d63b10c4fd6c9748

            SHA1

            358179dc6acaca3101c3b6f8af4d471267576d63

            SHA256

            270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

            SHA512

            8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

            Download Submit

          • C:\Program Files\Parsec\vusb\devcon.exe
            Filesize

            80KB

            MD5

            a9b2b49cc4457ad9d63b10c4fd6c9748

            SHA1

            358179dc6acaca3101c3b6f8af4d471267576d63

            SHA256

            270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

            SHA512

            8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

            Download Submit

          • C:\Program Files\Parsec\vusb\devcon.exe
            Filesize

            80KB

            MD5

            a9b2b49cc4457ad9d63b10c4fd6c9748

            SHA1

            358179dc6acaca3101c3b6f8af4d471267576d63

            SHA256

            270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

            SHA512

            8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

            Download Submit

          • C:\Program Files\Parsec\vusb\parsecvusba.inf
            Filesize

            2KB

            MD5

            83184628923227e514afa09b18adc463

            SHA1

            f5b18c8034dc3164efff6f685e330c096e51e5e4

            SHA256

            32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

            SHA512

            153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

            Download Submit

          • C:\Program Files\Parsec\wscripts\devcon-install.vbs
            Filesize

            339B

            MD5

            f3c6b9f1b6d0e119ff69945d34e5ebbe

            SHA1

            a1887ec6ce36d1b3546471f66c8862e0893ebaf7

            SHA256

            5ceb23a270bd473507e76a722212b47ffee3891870781c41d96e749e7534f24f

            SHA512

            20ab95ce40f49c64bee471d51110812f5789f5d7bba05bacf29c58f4549c972e8217e0e6971a60e63b798386720297ad97bf3021c5e755c711a1f350a57f5114

            Download Submit

          • C:\Program Files\Parsec\wscripts\devcon-remove.vbs
            Filesize

            306B

            MD5

            aa7ef5a944cc8488c9655d933610e1ba

            SHA1

            a100ddb0441701ef63f8b5fc2fdb4094ccbc55e1

            SHA256

            9e2531fdc309bfe88c6646e5883b36302480536e171540ce601fc4b10704e03f

            SHA512

            122dd1f6d6645f9f5844dd8c9498d1c1b3f0087938a65e23ffc9c2ed59c223fa00caeaea30a56a783a5844aa17baf05defa72976e7e8c5aec4bc056a7fe89c93

            Download Submit

          • C:\Program Files\Parsec\wscripts\firewall-add.vbs
            Filesize

            307B

            MD5

            882374285898f16b5f9ff44afc1ae701

            SHA1

            31c9445557c9b8ecda1f0a6d5ff666e01dd1c3ca

            SHA256

            0be5aa5cc6395a86878f56b131e13db4908e48f06e892ff8f8cf9e2d3b6c8abb

            SHA512

            3b05158b03b57a4d2cbfee9cef6adfe973d080264a88e5cdeb85c59b567529cd1cd2a3b5d8538cb8637d140fd8691dc8826388ab669b7bfb2d5c1c4174069243

            Download Submit

          • C:\Program Files\Parsec\wscripts\firewall-remove.vbs
            Filesize

            367B

            MD5

            5d4d70cdf36fcdaa292da1da9133320c

            SHA1

            92dc18d3d1128d43f482ab56804136c687b00713

            SHA256

            75f1dece4fda689a907f6d74b513adb0c1771c1b79ea71160179542c9c4ab2f0

            SHA512

            b54c92fbecb10ddf66d1b7ad950ffbc13f504c71081a8bd56c28c5689a2bf19bd81b467e0697c38f140c72a273eb9eb837105e738c6f1ac4f43344e2ab521778

            Download Submit

          • C:\Program Files\Parsec\wscripts\legacy-cleanup.vbs
            Filesize

            115B

            MD5

            c78520c3162c1962f3164714b37eb4d0

            SHA1

            67c19b8aea7ad99465976dbcd3efcfdd7d62e3fe

            SHA256

            dea38bd553abe93c689de42d0220add18f9be3e3d2fa53f97eb8649f586df4f3

            SHA512

            cfbfc2c7dd8019f98b77e8881680ef9d0135a210fb9b0136a4992c236d971e247aa1641cd2eafdc5f6f5bb61002b30ea14b226127c4cef04f3b3d6be3a941fcc

            Download Submit

          • C:\Program Files\Parsec\wscripts\service-install.vbs
            Filesize

            412B

            MD5

            971e2a344a6e17347a81eeb21ada7ba7

            SHA1

            37e034c29adda9b118b75bfdc7c6f41aac71e257

            SHA256

            01f62a12de3307b375dff3ebcd6961d76ffcbc24f70682c7875655a811ce76a1

            SHA512

            5ea0750dc07ff1a0eb1807043b48fb9ed54f6dcb96ce03cb543b0ea36d326779814b6cb87091373574911662a35d75b576e35c5b8d781db36fe1503f8287c65d

            Download Submit

          • C:\Program Files\Parsec\wscripts\service-kill-parsec.vbs
            Filesize

            105B

            MD5

            5a9e6b7ea8911aafca7d5299283795b9

            SHA1

            7b7c863302e2d5ff8b8f298be9eb2409292077cb

            SHA256

            f0a62d83920cf2cc4a5d5d3ac46b9a7d99b9835b58a6e63bca868941d08c5c9a

            SHA512

            c5611c99e139253abf9f6b60b1ffa4de438fa475901bfba24d18af82b523eb1bb79a83a89a09c253cacf4d9a50ed743d8e7acc12ecd9c59d488ade2af866ea66

            Download Submit

          • C:\Program Files\Parsec\wscripts\service-remove.vbs
            Filesize

            150B

            MD5

            b90e75dd7903cb2d6328bb3714865c7a

            SHA1

            2d32868deb198726ed5feb80b66542bad7fbacee

            SHA256

            970b3c2a9ea1906a177810990478932e3517f47aba267cf2ab9e4ba65e7b475f

            SHA512

            3d4bfb86ec98fd85843ae5b63dcf5f475c6500380f02bb4d0dee15a5f7e2334abdbbcd9420b8ac05b5beb8a63b9ea16abcd70ae01c04b87a423fc288ff4dca0a

            Download Submit

          • C:\Program Files\Parsec\wscripts\vdd-remove.vbs
            Filesize

            304B

            MD5

            7414c331d58788784f820f0b2cc7b5b0

            SHA1

            72301126d7a8cd2e21d5cd1a64844b08d0f4bebc

            SHA256

            300f15c94dae513508bd87e28b632a9342ebf3ca059050af5f54d3cb0ee5a9ff

            SHA512

            140258d6adb99a23af0f7b61605e5928dbd04d8295617773486f8c2dac7a7d29899b65b0bbb9558d5da3026de30569ca152f237df3d53597c68ecdec9bd86824

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsk94E3.tmp\ApplicationID.dll
            Filesize

            196KB

            MD5

            a858c1a57e32485505b1977cf0a125be

            SHA1

            25d86c4b51f7cc10fc70e3a0493a39c4460cc350

            SHA256

            1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4

            SHA512

            32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsk94E3.tmp\ApplicationID.dll
            Filesize

            196KB

            MD5

            a858c1a57e32485505b1977cf0a125be

            SHA1

            25d86c4b51f7cc10fc70e3a0493a39c4460cc350

            SHA256

            1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4

            SHA512

            32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsk94E3.tmp\System.dll
            Filesize

            12KB

            MD5

            0d7ad4f45dc6f5aa87f606d0331c6901

            SHA1

            48df0911f0484cbe2a8cdd5362140b63c41ee457

            SHA256

            3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

            SHA512

            c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsk94E3.tmp\nsDialogs.dll
            Filesize

            9KB

            MD5

            466179e1c8ee8a1ff5e4427dbb6c4a01

            SHA1

            eb607467009074278e4bd50c7eab400e95ae48f7

            SHA256

            1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

            SHA512

            7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{9ACFA~1\parsecvusba.cat
            Filesize

            11KB

            MD5

            49c8afa6763b5d017975c9972326c3df

            SHA1

            4dcf8012645ed1bdea60f8a9ee6d51f067417d08

            SHA256

            636dae8dcb26083bf2714578660b47ebc85ef09da6325f27b08a26714b887481

            SHA512

            7dbe4f10ecd670b6c62ae73a5b6ecf08dbba2fa52a3dec8250e415602ba15f38301d4f87fa32c557a48623c5e67522b8f8ffb49f778672e87cc9b68283718894

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{9ACFA~1\parsecvusba.sys
            Filesize

            250KB

            MD5

            abb460f37f439fce944476bf9b793ccc

            SHA1

            95022753eff69926ccf1673f76fad516843f3592

            SHA256

            92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

            SHA512

            9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{9acfa4c0-907c-9a4e-9cff-21655bd74ad4}\parsecvusba.cat
            Filesize

            11KB

            MD5

            49c8afa6763b5d017975c9972326c3df

            SHA1

            4dcf8012645ed1bdea60f8a9ee6d51f067417d08

            SHA256

            636dae8dcb26083bf2714578660b47ebc85ef09da6325f27b08a26714b887481

            SHA512

            7dbe4f10ecd670b6c62ae73a5b6ecf08dbba2fa52a3dec8250e415602ba15f38301d4f87fa32c557a48623c5e67522b8f8ffb49f778672e87cc9b68283718894

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{9acfa4c0-907c-9a4e-9cff-21655bd74ad4}\parsecvusba.inf
            Filesize

            2KB

            MD5

            83184628923227e514afa09b18adc463

            SHA1

            f5b18c8034dc3164efff6f685e330c096e51e5e4

            SHA256

            32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

            SHA512

            153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{9acfa4c0-907c-9a4e-9cff-21655bd74ad4}\parsecvusba.inf
            Filesize

            2KB

            MD5

            83184628923227e514afa09b18adc463

            SHA1

            f5b18c8034dc3164efff6f685e330c096e51e5e4

            SHA256

            32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

            SHA512

            153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{9acfa4c0-907c-9a4e-9cff-21655bd74ad4}\parsecvusba.sys
            Filesize

            250KB

            MD5

            abb460f37f439fce944476bf9b793ccc

            SHA1

            95022753eff69926ccf1673f76fad516843f3592

            SHA256

            92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

            SHA512

            9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\appdata.json
            Filesize

            155B

            MD5

            402a61c961006a551518f9174c4bdefc

            SHA1

            2ce0fb21a2a7aa057d4bcc934e9a2d1e95211f70

            SHA256

            6a4b62597d69a1d490fdbced9d0076551ce512b3d29ae018df4e9835f739aedb

            SHA512

            1ad72563de25d5c04d7d3267287d20a57f89a41d07b984fabb85f2b0c68ca2be8f8aa36d5d52b22819fe110a7fc99e961a53ebaa0d18296142d3d1b9f354f99c

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\appdata.json
            Filesize

            155B

            MD5

            402a61c961006a551518f9174c4bdefc

            SHA1

            2ce0fb21a2a7aa057d4bcc934e9a2d1e95211f70

            SHA256

            6a4b62597d69a1d490fdbced9d0076551ce512b3d29ae018df4e9835f739aedb

            SHA512

            1ad72563de25d5c04d7d3267287d20a57f89a41d07b984fabb85f2b0c68ca2be8f8aa36d5d52b22819fe110a7fc99e961a53ebaa0d18296142d3d1b9f354f99c

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\appdata.json
            Filesize

            132B

            MD5

            0ab8318ac6958dfef2c5f2708954017c

            SHA1

            88fe823f91ba7d0a2ddd8230518b1947f060e716

            SHA256

            f58b6995fd73abc1213bfcc4a7ce15f73503fef85f00f45515b6a80e16000849

            SHA512

            d4dbdf0785b3d845d3619a675170c1eb5562065c571ba79a757eb822f50c7543bfcca8bd849ab388d22d486b864682d35c34e277ca8e136880f85140b4725cd9

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-86h.dll
            Filesize

            3.2MB

            MD5

            864f36082ae99b72597e64fdd3420250

            SHA1

            73fa06def6cb66271778edc46b95e13f1149e843

            SHA256

            917e9c68ac5a6d9c22c3ce20382679caed91d81cd51a4545a7515331db0cd2b8

            SHA512

            9cc2b57196deb61f9390b171e9ca803afe814dcb424c149d5e8675cdd4d2f12003aa3fcb27a61e8d9c5268fb3150bac9cc34b8306ccd7c57c9fe32b71a43a220

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-86h.dll
            Filesize

            3.2MB

            MD5

            864f36082ae99b72597e64fdd3420250

            SHA1

            73fa06def6cb66271778edc46b95e13f1149e843

            SHA256

            917e9c68ac5a6d9c22c3ce20382679caed91d81cd51a4545a7515331db0cd2b8

            SHA512

            9cc2b57196deb61f9390b171e9ca803afe814dcb424c149d5e8675cdd4d2f12003aa3fcb27a61e8d9c5268fb3150bac9cc34b8306ccd7c57c9fe32b71a43a220

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-86h.dll
            Filesize

            3.2MB

            MD5

            864f36082ae99b72597e64fdd3420250

            SHA1

            73fa06def6cb66271778edc46b95e13f1149e843

            SHA256

            917e9c68ac5a6d9c22c3ce20382679caed91d81cd51a4545a7515331db0cd2b8

            SHA512

            9cc2b57196deb61f9390b171e9ca803afe814dcb424c149d5e8675cdd4d2f12003aa3fcb27a61e8d9c5268fb3150bac9cc34b8306ccd7c57c9fe32b71a43a220

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-86h.dll
            Filesize

            3.2MB

            MD5

            864f36082ae99b72597e64fdd3420250

            SHA1

            73fa06def6cb66271778edc46b95e13f1149e843

            SHA256

            917e9c68ac5a6d9c22c3ce20382679caed91d81cd51a4545a7515331db0cd2b8

            SHA512

            9cc2b57196deb61f9390b171e9ca803afe814dcb424c149d5e8675cdd4d2f12003aa3fcb27a61e8d9c5268fb3150bac9cc34b8306ccd7c57c9fe32b71a43a220

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-87c.dll
            Filesize

            3.1MB

            MD5

            572bae1c94eef2115b21fa7b0d659e54

            SHA1

            e2c2003bdacc595c4767a1e9ba5cc549c3989379

            SHA256

            641e9989c6a32ae486dbbc4bc7f9f32c1333e7b9f00341f8b80261cb8b6979b8

            SHA512

            c246b04800ea2bdac6eec2f1de8e17fbc50d486761b9cbf5c2002fc35e2c4669e56854389cd09d406920eafc015f5c70ad3cfc0d28c9584bc54ae5f33a5dab7c

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-87c.dll
            Filesize

            3.1MB

            MD5

            572bae1c94eef2115b21fa7b0d659e54

            SHA1

            e2c2003bdacc595c4767a1e9ba5cc549c3989379

            SHA256

            641e9989c6a32ae486dbbc4bc7f9f32c1333e7b9f00341f8b80261cb8b6979b8

            SHA512

            c246b04800ea2bdac6eec2f1de8e17fbc50d486761b9cbf5c2002fc35e2c4669e56854389cd09d406920eafc015f5c70ad3cfc0d28c9584bc54ae5f33a5dab7c

            Download Submit

          • C:\Windows\INF\oem3.inf
            Filesize

            2KB

            MD5

            83184628923227e514afa09b18adc463

            SHA1

            f5b18c8034dc3164efff6f685e330c096e51e5e4

            SHA256

            32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

            SHA512

            153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

            Download Submit

          • C:\Windows\System32\DriverStore\FileRepository\PARSEC~1.INF\parsecvusba.sys
            Filesize

            250KB

            MD5

            abb460f37f439fce944476bf9b793ccc

            SHA1

            95022753eff69926ccf1673f76fad516843f3592

            SHA256

            92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

            SHA512

            9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

            Download Submit

          • C:\Windows\System32\DriverStore\FileRepository\parsecvusba.inf_amd64_ee9c44e2bc310c6a\parsecvusba.inf
            Filesize

            2KB

            MD5

            83184628923227e514afa09b18adc463

            SHA1

            f5b18c8034dc3164efff6f685e330c096e51e5e4

            SHA256

            32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

            SHA512

            153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

            Download Submit

          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
            Filesize

            471B

            MD5

            88bdbcd4b3459b8d64300776ac32ae89

            SHA1

            36db5f85b7ebc796b193c95a9d85609c3a9a3c37

            SHA256

            7a8623cb830aa50457814a61dd20e79358b295ee64db4046bc38b553d0c6c8de

            SHA512

            1256c5e16a3290b01775e1662a60e4f59baf7c13b9e33d2b7fd719b247b4747e70dd4b5bfdff0f79235914e04c7a7712974e0ae59629bafc2bc1d6f501a7749e

            Download Submit

          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_4A9A0BBEBC0AA728CF9BFF068BE5A494
            Filesize

            471B

            MD5

            b9742aa1c700d8ac3f4246f06bf5192e

            SHA1

            664c3740ee48817e7919f668c27aee9142bd8841

            SHA256

            a7a661f411616049e58238d0e7a809fc7ca49ab4cfbc5658d37334a7dc610c43

            SHA512

            4cfd8f05d4931b11cacf96b12bd71098f50aa59008fa341fc9406426f343d90d14d1f898e42c4f8f94ddfdd65b3607e15f6c368b6f243a09390d8f5bf02107ca

            Download Submit

          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
            Filesize

            426B

            MD5

            b1a674dfcaf40adb8a262b96c6795bc6

            SHA1

            1c4627ff8f9e2a170c9f887c84c36ad83e58f724

            SHA256

            14068ca05260ff1995b663785cd003a31eb65d003987c57a56e00d949e0276e5

            SHA512

            0911f7b192bd5da2471bc10e38ef39e4481ddd8487f6acb80c50dea076a60540de8d7497f21fb8df5a94e11884740868693cc7aaf25144f3b57275c4e254c9ed

            Download Submit

          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_4A9A0BBEBC0AA728CF9BFF068BE5A494
            Filesize

            420B

            MD5

            15a76e5263c0818255884ec4f2c2fbdd

            SHA1

            8f5d162c548b8032f8561acd08d5f7abc5b96bc3

            SHA256

            b8938d48825149eb5f89ccc40ae2b63db763d32864f8040f4c73297eb90d081f

            SHA512

            caa6e437f54f832a6740419b2e912ecc8d1a094a72d6baac6f2e6826ab8bc1138e08d95d8b8ff08f7aa9507990cca2e856488ef83232869821e374e9a005c78a

            Download Submit

          • \??\c:\PROGRA~1\parsec\vusb\parsecvusba.sys
            Filesize

            250KB

            MD5

            abb460f37f439fce944476bf9b793ccc

            SHA1

            95022753eff69926ccf1673f76fad516843f3592

            SHA256

            92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

            SHA512

            9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

            Download Submit

          • \??\c:\program files\parsec\vusb\parsecvusba.cat
            Filesize

            11KB

            MD5

            49c8afa6763b5d017975c9972326c3df

            SHA1

            4dcf8012645ed1bdea60f8a9ee6d51f067417d08

            SHA256

            636dae8dcb26083bf2714578660b47ebc85ef09da6325f27b08a26714b887481

            SHA512

            7dbe4f10ecd670b6c62ae73a5b6ecf08dbba2fa52a3dec8250e415602ba15f38301d4f87fa32c557a48623c5e67522b8f8ffb49f778672e87cc9b68283718894

            Download Submit