Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

parsec-windows.exe

windows7-x64

3

parsec-windows.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2023, 19:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    parsec-windows.exe

  • Size

    2.7MB

  • MD5

    86c3e34147f64ca7b0bcfe4564317706

  • SHA1

    dffbf6d25bcfe675fc314968a4413ba9757b6c25

  • SHA256

    e17c059a2ec3153241f4cddf8081f19e83af890cb9126f3e1528474c29610786

  • SHA512

    8d5f2efa99de7c6275162927b77dc3b5d640fbd18d771cff71ee7bd3cb8009d87fa23b8f29113d15aaca17b7aaa33a440434ba1ac2db7c1998d14673d31d4e5c

  • SSDEEP

    49152:P3myVbHOO2Q4gSrF32OL5OsrcnWYBR959Cenopym7r4bvwfIr+Z4NJU/EPM/Ob:PWyBH52oYZLTrcWYn959CeTIIr+eXUSf

Score
8/10
discoveryevasionpersistence

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 1 TTPs 4 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 6 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\service-kill-parsec.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" control Parsec 200
        3⤵
        • Launches sc.exe
        PID:1788
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\devcon-remove.vbs" "C:\Program Files\Parsec\vusb\"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Program Files\Parsec\vusb\devcon.exe
        "C:\Program Files\Parsec\vusb\devcon.exe" remove Root\Parsec\VUSBA
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3948
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\vdd-remove.vbs" "C:\Program Files\Parsec\vdd\"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Program Files\Parsec\vdd\devcon.exe
        "C:\Program Files\Parsec\vdd\devcon.exe" remove Root\Parsec\VDA
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4056
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\service-remove.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" stop Parsec
        3⤵
        • Launches sc.exe
        PID:4404
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" delete Parsec
        3⤵
        • Launches sc.exe
        PID:1700
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\firewall-remove.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name=Parsec
        3⤵
        • Modifies Windows Firewall
        PID:2136
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name=parsec.exe
        3⤵
        • Modifies Windows Firewall
        PID:4352
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name=parsecd.exe
        3⤵
        • Modifies Windows Firewall
        PID:2196
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\legacy-cleanup.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn ParsecTeams /f
        3⤵
          PID:1996
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\service-install.vbs" "C:\Program Files\Parsec\pservice.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create Parsec binPath= "\"C:\Program Files\Parsec\pservice.exe\"" start= auto type= interact type= own
          3⤵
          • Launches sc.exe
          PID:2104
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start Parsec
          3⤵
          • Launches sc.exe
          PID:3248
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\firewall-add.vbs" "C:\Program Files\Parsec\parsecd.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name=Parsec dir=in action=allow program="C:\Program Files\Parsec\parsecd.exe" enable=yes profile=public,private,domain
          3⤵
          • Modifies Windows Firewall
          PID:3280
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\system32\wscript.exe" "C:\Program Files\Parsec\wscripts\devcon-install.vbs" "C:\Program Files\Parsec\vusb\"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Program Files\Parsec\vusb\devcon.exe
          "C:\Program Files\Parsec\vusb\devcon.exe" install "C:\Program Files\Parsec\vusb\parsecvusba.inf" Root\Parsec\VUSBA
          3⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4196
      • C:\Program Files\Parsec\parsecd.exe
        "C:\Program Files\Parsec\parsecd.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:4480
    • C:\Program Files\Parsec\pservice.exe
      "C:\Program Files\Parsec\pservice.exe"
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2760
      • C:\Program Files\Parsec\parsecd.exe
        "C:\Program Files\Parsec\parsecd.exe" SERVICE_LAUNCHED_V7
        2⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3684
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{97803e52-0372-194d-978b-e25580e9eed8}\parsecvusba.inf" "9" "4419fa153" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\parsec\vusb"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3792
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce884b7ae9cce:parsecvusba_Device:0.1.1.0:root\parsec\vusba," "4419fa153" "0000000000000148"
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1436
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x520 0x448
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1288

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Parsec\parsecd.exe
      Filesize

      450KB

      MD5

      ce98489ae22d6e345e91949bacddb4c0

      SHA1

      646c002e53a2e406d3ba9ba26d8ad7d514110b32

      SHA256

      6d2029d705bb5baa38f0cfa2d767ebb7e9565323328aca286255bd690e9987db

      SHA512

      cb3e9da4c1f9c0f66aa9768525d6b39ca40c2b42780009b1c8276d43801cb76938bad4b92b0fb65da9847428826d5ef4eaec17bfd6e82cc0e71efe785232028c

      Download Submit

    • C:\Program Files\Parsec\parsecd.exe
      Filesize

      450KB

      MD5

      ce98489ae22d6e345e91949bacddb4c0

      SHA1

      646c002e53a2e406d3ba9ba26d8ad7d514110b32

      SHA256

      6d2029d705bb5baa38f0cfa2d767ebb7e9565323328aca286255bd690e9987db

      SHA512

      cb3e9da4c1f9c0f66aa9768525d6b39ca40c2b42780009b1c8276d43801cb76938bad4b92b0fb65da9847428826d5ef4eaec17bfd6e82cc0e71efe785232028c

      Download Submit

    • C:\Program Files\Parsec\parsecd.exe
      Filesize

      450KB

      MD5

      ce98489ae22d6e345e91949bacddb4c0

      SHA1

      646c002e53a2e406d3ba9ba26d8ad7d514110b32

      SHA256

      6d2029d705bb5baa38f0cfa2d767ebb7e9565323328aca286255bd690e9987db

      SHA512

      cb3e9da4c1f9c0f66aa9768525d6b39ca40c2b42780009b1c8276d43801cb76938bad4b92b0fb65da9847428826d5ef4eaec17bfd6e82cc0e71efe785232028c

      Download Submit

    • C:\Program Files\Parsec\parsecd.exe
      Filesize

      450KB

      MD5

      ce98489ae22d6e345e91949bacddb4c0

      SHA1

      646c002e53a2e406d3ba9ba26d8ad7d514110b32

      SHA256

      6d2029d705bb5baa38f0cfa2d767ebb7e9565323328aca286255bd690e9987db

      SHA512

      cb3e9da4c1f9c0f66aa9768525d6b39ca40c2b42780009b1c8276d43801cb76938bad4b92b0fb65da9847428826d5ef4eaec17bfd6e82cc0e71efe785232028c

      Download Submit

    • C:\Program Files\Parsec\pservice.exe
      Filesize

      406KB

      MD5

      e2c143ea07596857aefe2499f22ad400

      SHA1

      0dcc27100be26c6a43590aa9a1be1d21f266cd3a

      SHA256

      4c875900211b3e5de2438e5df94421bf56c256628b255bbbf37f8c919bae1936

      SHA512

      baa49cbaf976a1dcb7059390eed65f70db73d2e883a09e46291a26873df9b0809ba50c407554c79d1215e57b6446cf1e0853e5d367467871d008d6b53e92f160

      Download Submit

    • C:\Program Files\Parsec\pservice.exe
      Filesize

      406KB

      MD5

      e2c143ea07596857aefe2499f22ad400

      SHA1

      0dcc27100be26c6a43590aa9a1be1d21f266cd3a

      SHA256

      4c875900211b3e5de2438e5df94421bf56c256628b255bbbf37f8c919bae1936

      SHA512

      baa49cbaf976a1dcb7059390eed65f70db73d2e883a09e46291a26873df9b0809ba50c407554c79d1215e57b6446cf1e0853e5d367467871d008d6b53e92f160

      Download Submit

    • C:\Program Files\Parsec\skel\appdata.json
      Filesize

      155B

      MD5

      650dea764c7bd8bb96dcb8bdbb7c7de9

      SHA1

      776daa3c2923d52c86fc167a2b9e6944ee087178

      SHA256

      66bc1fc3a8df99b1b8691d22f7165fcb6293bc6c84d7b525215321c1b5d06e81

      SHA512

      54bb8b1ea9189e21017054acd0ba70f7e11e0d22dfca5c22e7a8026c3890edecead6505e2d4a9a1a3d447db06351607c204b43964bbd78702d08e28b5ada2c29

      Download Submit

    • C:\Program Files\Parsec\skel\parsecd-150-87d.dll
      Filesize

      3.1MB

      MD5

      1c76bee252aa9fb75e6d0108a5a84261

      SHA1

      dc02ad5234182e4f35b0aeaedf379273c61ff437

      SHA256

      8eff81ca6932d5a69604f9546a8133e48730852dfbc234e6df3d0f33cc746e6a

      SHA512

      da1481a3ca4563e7d27ad066547738aa94799f004b334b317f8acb499642ddb8b7bc0bad1e89bf0a26f4ae7e65bce7d1c72099929faef9db7ddabb5df73542e1

      Download Submit

    • C:\Program Files\Parsec\vdd\devcon.exe
      Filesize

      80KB

      MD5

      a9b2b49cc4457ad9d63b10c4fd6c9748

      SHA1

      358179dc6acaca3101c3b6f8af4d471267576d63

      SHA256

      270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

      SHA512

      8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

      Download Submit

    • C:\Program Files\Parsec\vdd\devcon.exe
      Filesize

      80KB

      MD5

      a9b2b49cc4457ad9d63b10c4fd6c9748

      SHA1

      358179dc6acaca3101c3b6f8af4d471267576d63

      SHA256

      270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

      SHA512

      8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

      Download Submit

    • C:\Program Files\Parsec\vusb\devcon.exe
      Filesize

      80KB

      MD5

      a9b2b49cc4457ad9d63b10c4fd6c9748

      SHA1

      358179dc6acaca3101c3b6f8af4d471267576d63

      SHA256

      270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

      SHA512

      8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

      Download Submit

    • C:\Program Files\Parsec\vusb\devcon.exe
      Filesize

      80KB

      MD5

      a9b2b49cc4457ad9d63b10c4fd6c9748

      SHA1

      358179dc6acaca3101c3b6f8af4d471267576d63

      SHA256

      270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

      SHA512

      8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

      Download Submit

    • C:\Program Files\Parsec\vusb\devcon.exe
      Filesize

      80KB

      MD5

      a9b2b49cc4457ad9d63b10c4fd6c9748

      SHA1

      358179dc6acaca3101c3b6f8af4d471267576d63

      SHA256

      270836795917367e22d843df92a535004143515e9ea9bbdeb056a27c82ad6daa

      SHA512

      8b958943667d73d479e3943f752248bdf13f3c7f242d2ca7ac13ca81a7318e737b78e3172a726c7de040c9ae442ee9fb53245153f6f3d965562070c6f097f34a

      Download Submit

    • C:\Program Files\Parsec\vusb\parsecvusba.inf
      Filesize

      2KB

      MD5

      83184628923227e514afa09b18adc463

      SHA1

      f5b18c8034dc3164efff6f685e330c096e51e5e4

      SHA256

      32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

      SHA512

      153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

      Download Submit

    • C:\Program Files\Parsec\wscripts\devcon-install.vbs
      Filesize

      339B

      MD5

      f3c6b9f1b6d0e119ff69945d34e5ebbe

      SHA1

      a1887ec6ce36d1b3546471f66c8862e0893ebaf7

      SHA256

      5ceb23a270bd473507e76a722212b47ffee3891870781c41d96e749e7534f24f

      SHA512

      20ab95ce40f49c64bee471d51110812f5789f5d7bba05bacf29c58f4549c972e8217e0e6971a60e63b798386720297ad97bf3021c5e755c711a1f350a57f5114

      Download Submit

    • C:\Program Files\Parsec\wscripts\devcon-remove.vbs
      Filesize

      306B

      MD5

      aa7ef5a944cc8488c9655d933610e1ba

      SHA1

      a100ddb0441701ef63f8b5fc2fdb4094ccbc55e1

      SHA256

      9e2531fdc309bfe88c6646e5883b36302480536e171540ce601fc4b10704e03f

      SHA512

      122dd1f6d6645f9f5844dd8c9498d1c1b3f0087938a65e23ffc9c2ed59c223fa00caeaea30a56a783a5844aa17baf05defa72976e7e8c5aec4bc056a7fe89c93

      Download Submit

    • C:\Program Files\Parsec\wscripts\firewall-add.vbs
      Filesize

      307B

      MD5

      882374285898f16b5f9ff44afc1ae701

      SHA1

      31c9445557c9b8ecda1f0a6d5ff666e01dd1c3ca

      SHA256

      0be5aa5cc6395a86878f56b131e13db4908e48f06e892ff8f8cf9e2d3b6c8abb

      SHA512

      3b05158b03b57a4d2cbfee9cef6adfe973d080264a88e5cdeb85c59b567529cd1cd2a3b5d8538cb8637d140fd8691dc8826388ab669b7bfb2d5c1c4174069243

      Download Submit

    • C:\Program Files\Parsec\wscripts\firewall-remove.vbs
      Filesize

      367B

      MD5

      5d4d70cdf36fcdaa292da1da9133320c

      SHA1

      92dc18d3d1128d43f482ab56804136c687b00713

      SHA256

      75f1dece4fda689a907f6d74b513adb0c1771c1b79ea71160179542c9c4ab2f0

      SHA512

      b54c92fbecb10ddf66d1b7ad950ffbc13f504c71081a8bd56c28c5689a2bf19bd81b467e0697c38f140c72a273eb9eb837105e738c6f1ac4f43344e2ab521778

      Download Submit

    • C:\Program Files\Parsec\wscripts\legacy-cleanup.vbs
      Filesize

      115B

      MD5

      c78520c3162c1962f3164714b37eb4d0

      SHA1

      67c19b8aea7ad99465976dbcd3efcfdd7d62e3fe

      SHA256

      dea38bd553abe93c689de42d0220add18f9be3e3d2fa53f97eb8649f586df4f3

      SHA512

      cfbfc2c7dd8019f98b77e8881680ef9d0135a210fb9b0136a4992c236d971e247aa1641cd2eafdc5f6f5bb61002b30ea14b226127c4cef04f3b3d6be3a941fcc

      Download Submit

    • C:\Program Files\Parsec\wscripts\service-install.vbs
      Filesize

      412B

      MD5

      971e2a344a6e17347a81eeb21ada7ba7

      SHA1

      37e034c29adda9b118b75bfdc7c6f41aac71e257

      SHA256

      01f62a12de3307b375dff3ebcd6961d76ffcbc24f70682c7875655a811ce76a1

      SHA512

      5ea0750dc07ff1a0eb1807043b48fb9ed54f6dcb96ce03cb543b0ea36d326779814b6cb87091373574911662a35d75b576e35c5b8d781db36fe1503f8287c65d

      Download Submit

    • C:\Program Files\Parsec\wscripts\service-kill-parsec.vbs
      Filesize

      105B

      MD5

      5a9e6b7ea8911aafca7d5299283795b9

      SHA1

      7b7c863302e2d5ff8b8f298be9eb2409292077cb

      SHA256

      f0a62d83920cf2cc4a5d5d3ac46b9a7d99b9835b58a6e63bca868941d08c5c9a

      SHA512

      c5611c99e139253abf9f6b60b1ffa4de438fa475901bfba24d18af82b523eb1bb79a83a89a09c253cacf4d9a50ed743d8e7acc12ecd9c59d488ade2af866ea66

      Download Submit

    • C:\Program Files\Parsec\wscripts\service-remove.vbs
      Filesize

      150B

      MD5

      b90e75dd7903cb2d6328bb3714865c7a

      SHA1

      2d32868deb198726ed5feb80b66542bad7fbacee

      SHA256

      970b3c2a9ea1906a177810990478932e3517f47aba267cf2ab9e4ba65e7b475f

      SHA512

      3d4bfb86ec98fd85843ae5b63dcf5f475c6500380f02bb4d0dee15a5f7e2334abdbbcd9420b8ac05b5beb8a63b9ea16abcd70ae01c04b87a423fc288ff4dca0a

      Download Submit

    • C:\Program Files\Parsec\wscripts\vdd-remove.vbs
      Filesize

      304B

      MD5

      7414c331d58788784f820f0b2cc7b5b0

      SHA1

      72301126d7a8cd2e21d5cd1a64844b08d0f4bebc

      SHA256

      300f15c94dae513508bd87e28b632a9342ebf3ca059050af5f54d3cb0ee5a9ff

      SHA512

      140258d6adb99a23af0f7b61605e5928dbd04d8295617773486f8c2dac7a7d29899b65b0bbb9558d5da3026de30569ca152f237df3d53597c68ecdec9bd86824

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsz293F.tmp\ApplicationID.dll
      Filesize

      196KB

      MD5

      a858c1a57e32485505b1977cf0a125be

      SHA1

      25d86c4b51f7cc10fc70e3a0493a39c4460cc350

      SHA256

      1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4

      SHA512

      32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsz293F.tmp\ApplicationID.dll
      Filesize

      196KB

      MD5

      a858c1a57e32485505b1977cf0a125be

      SHA1

      25d86c4b51f7cc10fc70e3a0493a39c4460cc350

      SHA256

      1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4

      SHA512

      32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsz293F.tmp\System.dll
      Filesize

      12KB

      MD5

      cff85c549d536f651d4fb8387f1976f2

      SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

      SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

      SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsz293F.tmp\nsDialogs.dll
      Filesize

      9KB

      MD5

      6c3f8c94d0727894d706940a8a980543

      SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

      SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

      SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{97803e52-0372-194d-978b-e25580e9eed8}\parsecvusba.cat
      Filesize

      11KB

      MD5

      49c8afa6763b5d017975c9972326c3df

      SHA1

      4dcf8012645ed1bdea60f8a9ee6d51f067417d08

      SHA256

      636dae8dcb26083bf2714578660b47ebc85ef09da6325f27b08a26714b887481

      SHA512

      7dbe4f10ecd670b6c62ae73a5b6ecf08dbba2fa52a3dec8250e415602ba15f38301d4f87fa32c557a48623c5e67522b8f8ffb49f778672e87cc9b68283718894

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{97803e52-0372-194d-978b-e25580e9eed8}\parsecvusba.inf
      Filesize

      2KB

      MD5

      83184628923227e514afa09b18adc463

      SHA1

      f5b18c8034dc3164efff6f685e330c096e51e5e4

      SHA256

      32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

      SHA512

      153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{97803e52-0372-194d-978b-e25580e9eed8}\parsecvusba.inf
      Filesize

      2KB

      MD5

      83184628923227e514afa09b18adc463

      SHA1

      f5b18c8034dc3164efff6f685e330c096e51e5e4

      SHA256

      32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

      SHA512

      153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{97803e52-0372-194d-978b-e25580e9eed8}\parsecvusba.sys
      Filesize

      250KB

      MD5

      abb460f37f439fce944476bf9b793ccc

      SHA1

      95022753eff69926ccf1673f76fad516843f3592

      SHA256

      92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

      SHA512

      9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{97803~1\parsecvusba.cat
      Filesize

      11KB

      MD5

      49c8afa6763b5d017975c9972326c3df

      SHA1

      4dcf8012645ed1bdea60f8a9ee6d51f067417d08

      SHA256

      636dae8dcb26083bf2714578660b47ebc85ef09da6325f27b08a26714b887481

      SHA512

      7dbe4f10ecd670b6c62ae73a5b6ecf08dbba2fa52a3dec8250e415602ba15f38301d4f87fa32c557a48623c5e67522b8f8ffb49f778672e87cc9b68283718894

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{97803~1\parsecvusba.sys
      Filesize

      250KB

      MD5

      abb460f37f439fce944476bf9b793ccc

      SHA1

      95022753eff69926ccf1673f76fad516843f3592

      SHA256

      92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

      SHA512

      9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Parsec\appdata.json
      Filesize

      155B

      MD5

      650dea764c7bd8bb96dcb8bdbb7c7de9

      SHA1

      776daa3c2923d52c86fc167a2b9e6944ee087178

      SHA256

      66bc1fc3a8df99b1b8691d22f7165fcb6293bc6c84d7b525215321c1b5d06e81

      SHA512

      54bb8b1ea9189e21017054acd0ba70f7e11e0d22dfca5c22e7a8026c3890edecead6505e2d4a9a1a3d447db06351607c204b43964bbd78702d08e28b5ada2c29

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Parsec\appdata.json
      Filesize

      155B

      MD5

      650dea764c7bd8bb96dcb8bdbb7c7de9

      SHA1

      776daa3c2923d52c86fc167a2b9e6944ee087178

      SHA256

      66bc1fc3a8df99b1b8691d22f7165fcb6293bc6c84d7b525215321c1b5d06e81

      SHA512

      54bb8b1ea9189e21017054acd0ba70f7e11e0d22dfca5c22e7a8026c3890edecead6505e2d4a9a1a3d447db06351607c204b43964bbd78702d08e28b5ada2c29

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-87d.dll
      Filesize

      3.1MB

      MD5

      1c76bee252aa9fb75e6d0108a5a84261

      SHA1

      dc02ad5234182e4f35b0aeaedf379273c61ff437

      SHA256

      8eff81ca6932d5a69604f9546a8133e48730852dfbc234e6df3d0f33cc746e6a

      SHA512

      da1481a3ca4563e7d27ad066547738aa94799f004b334b317f8acb499642ddb8b7bc0bad1e89bf0a26f4ae7e65bce7d1c72099929faef9db7ddabb5df73542e1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-87d.dll
      Filesize

      3.1MB

      MD5

      1c76bee252aa9fb75e6d0108a5a84261

      SHA1

      dc02ad5234182e4f35b0aeaedf379273c61ff437

      SHA256

      8eff81ca6932d5a69604f9546a8133e48730852dfbc234e6df3d0f33cc746e6a

      SHA512

      da1481a3ca4563e7d27ad066547738aa94799f004b334b317f8acb499642ddb8b7bc0bad1e89bf0a26f4ae7e65bce7d1c72099929faef9db7ddabb5df73542e1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-87d.dll
      Filesize

      3.1MB

      MD5

      1c76bee252aa9fb75e6d0108a5a84261

      SHA1

      dc02ad5234182e4f35b0aeaedf379273c61ff437

      SHA256

      8eff81ca6932d5a69604f9546a8133e48730852dfbc234e6df3d0f33cc746e6a

      SHA512

      da1481a3ca4563e7d27ad066547738aa94799f004b334b317f8acb499642ddb8b7bc0bad1e89bf0a26f4ae7e65bce7d1c72099929faef9db7ddabb5df73542e1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Parsec\parsecd-150-87d.dll
      Filesize

      3.1MB

      MD5

      1c76bee252aa9fb75e6d0108a5a84261

      SHA1

      dc02ad5234182e4f35b0aeaedf379273c61ff437

      SHA256

      8eff81ca6932d5a69604f9546a8133e48730852dfbc234e6df3d0f33cc746e6a

      SHA512

      da1481a3ca4563e7d27ad066547738aa94799f004b334b317f8acb499642ddb8b7bc0bad1e89bf0a26f4ae7e65bce7d1c72099929faef9db7ddabb5df73542e1

      Download Submit

    • C:\Windows\INF\oem3.inf
      Filesize

      2KB

      MD5

      83184628923227e514afa09b18adc463

      SHA1

      f5b18c8034dc3164efff6f685e330c096e51e5e4

      SHA256

      32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

      SHA512

      153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

      Download Submit

    • C:\Windows\System32\DriverStore\FileRepository\PARSEC~1.INF\parsecvusba.sys
      Filesize

      250KB

      MD5

      abb460f37f439fce944476bf9b793ccc

      SHA1

      95022753eff69926ccf1673f76fad516843f3592

      SHA256

      92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

      SHA512

      9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

      Download Submit

    • C:\Windows\System32\DriverStore\FileRepository\parsecvusba.inf_amd64_ee9c44e2bc310c6a\parsecvusba.inf
      Filesize

      2KB

      MD5

      83184628923227e514afa09b18adc463

      SHA1

      f5b18c8034dc3164efff6f685e330c096e51e5e4

      SHA256

      32a2e842576629cea6bd3b4041df08c8b74ce1e87f260af61b27c1b941b96bfc

      SHA512

      153fa5aa375fda2a9a735262027cae456875650614c6e8f958f6824af93cf43fc084c16b77873a8e8413129151c802803531b4c14b5997dd20759feb5f589da7

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
      Filesize

      471B

      MD5

      1a7172ae553f9810a01d5f373a45c412

      SHA1

      6557718f165fba18dea798559859b9e46b210176

      SHA256

      7184001f93d4b53c86457fa647b6fb88d1346641643cdbe6767e02e4719549aa

      SHA512

      db8ffa3b8465f7951156bc7f334df5994f16373790d6364f264cd828794646951b727c77ea5bb52ae6446f6aeb82547c6b4bda9d7c0e08614bc5fe7286abd426

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_4A9A0BBEBC0AA728CF9BFF068BE5A494
      Filesize

      471B

      MD5

      4922f5291a10c6e1f1ea19898becfa6b

      SHA1

      8287df1cbeeb339e964cfc0fea020ddcd96daace

      SHA256

      3108841b83c0fd1ad58e12b9b6e6cba80995c1e4b9ac6fcfa2fde04d6acca347

      SHA512

      e5e66c85991f0c0744d0235391ca7fd2053218b52cc7a333fafe75cbe4b21834954276ec83bc6b487260c1039783e30bbcc6c3dfa920cdcab07cc71008e92595

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
      Filesize

      396B

      MD5

      a6ac848db4e774d453ac4a45d6344dcb

      SHA1

      49ea606d0b4bf0b602a834e63a7d388c890e78ce

      SHA256

      696c4c762f0864773e0959163b46df8baa05dae84f40246facb9c3df4800034a

      SHA512

      42c6d5ee95569971d7d575d518beae5d4f8ffa8ddedb0f1a7098026bb1dea5a36a621fcb4396c674b7181674b551775e8e5e237aa75733b17d004517b4fc6c29

      Download Submit

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_4A9A0BBEBC0AA728CF9BFF068BE5A494
      Filesize

      420B

      MD5

      ce2497594e562505b2cc8c307358665a

      SHA1

      df7a34005fd47108e2864d2de2b38d639e9ece4a

      SHA256

      7d5f885a83a6afc74eff698b92d4dd22d93e8d452b9371934b928530142fc743

      SHA512

      b9d32446c5987c5bc607be706e50880a24bbad3f410c5048928af557955ee145328f524d6ad5e063c64ca4ea30cb75542971ae590d711a7960b6db88ce66b682

      Download Submit

    • \??\c:\PROGRA~1\parsec\vusb\parsecvusba.sys
      Filesize

      250KB

      MD5

      abb460f37f439fce944476bf9b793ccc

      SHA1

      95022753eff69926ccf1673f76fad516843f3592

      SHA256

      92411ce987e52951e39f3454fb0579188b225f613394b2b566f2247f3964876e

      SHA512

      9456d6cd809d0697cc9e2ad053cbe36222458023400a2862c9e9c14a0bef037b66c858414796f02741c5dcd6824c27dc0a7f3ab73ef4c1da64f02dcbb38898ba

      Download Submit

    • \??\c:\program files\parsec\vusb\parsecvusba.cat
      Filesize

      11KB

      MD5

      49c8afa6763b5d017975c9972326c3df

      SHA1

      4dcf8012645ed1bdea60f8a9ee6d51f067417d08

      SHA256

      636dae8dcb26083bf2714578660b47ebc85ef09da6325f27b08a26714b887481

      SHA512

      7dbe4f10ecd670b6c62ae73a5b6ecf08dbba2fa52a3dec8250e415602ba15f38301d4f87fa32c557a48623c5e67522b8f8ffb49f778672e87cc9b68283718894

      Download Submit