parsec-windows[.]exe

resource
unpack001/$PLUGINSDIR/ApplicationID.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/vusb/parsec-vud.exe

parsec-windows.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 ae5b66322e5a7c26ad21ccc556bdc1618796166565d2939142c5aa3d76c38ace
MD5 01ef58e7c144c701b2ea01cfc049dbe4
SHA1 2f572accb519096c9ea805812ba53703c16cceea
SHA512 434fd6d4eb49669617da3a15c2239a2cf524624cc4fcf9f09d8bb78a40ddf2dc5e70105e6708ce7643448f3176301edd64a9b71244c179a836119532d7dd69a6
SSDEEP 98304:QsSoMQnPLeMNCvYa59QKS7XnqSsAVlsX4pIDmjjcrhm2NGbUU:QsSByeMj04VlslQsm2NK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

29:43:27:e5:51:4a:ea:bf:f9:de:63:e1:62:9a:63:ce:0f:15:6d:75:26:22:6a:5f:10:68:f2:24:16:e9:31:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 28, 2024

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/ApplicationID.dll

IMPHASH 9b38d46d6882ee63437c721734be794c
SHA256 1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4
MD5 a858c1a57e32485505b1977cf0a125be
SHA1 25d86c4b51f7cc10fc70e3a0493a39c4460cc350
SHA512 32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d
SSDEEP 3072:2pBNN6AmU9cDlKd3P6V9nSm49WTgKg4Fa1V3FuXRAuAg0FubA9cVsL+73:2pzxmQ3yL+9MgKbxAOEXY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

33165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\src\NSIS-ApplicationID\Release\ApplicationID.pdb

kernel32

MultiByteToWideChar GlobalAlloc GlobalFree lstrcpynA WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException GetLastError FreeLibrary LoadLibraryExW InterlockedFlushSList HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetStdHandle GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize CreateFileW

shell32

SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName

ole32

CoCreateInstance CoInitialize CoUninitialize

shlwapi

SHStrDupW

Name

.text

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH c1c7505e1e6e929ebb6b9100e55b050a
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

parsecd.exe

IMPHASH 43e208612bb1b7bf9a2d6ef93d7ffeec
SHA256 6f1be9e26e403a885cc3b1ff0e4dbecbc96c0821119d25990c3e211564f215d5
MD5 62beb668110b4c5ddad09bb20d921cb6
SHA1 f3706372c01d1e607ff8c605307de6ef2c26c1a4
SHA512 8994c3f1c78b0a816ecf30e463af8d6ddfd0a0ce7b962cbf13e9bbd360d37a024b8ee69c76745f4c332a4786dbfb9216667b1d03c32c60a7c06e85359a2186ee
SSDEEP 6144:rkdyuNAbS9p400tm61bXdCwx+3y6kR1DnjvGms7X5od0:rkUuNAbS9p9cx1rdCwh6+/+msjmd0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

b8:f6:23:f1:9a:9f:e8:f4:0b:27:a0:a4:bb:06:37:be:a8:33:17:3a:d2:cf:7d:54:b0:04:f9:e0:b8:d1:5b:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 24, 2023

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

134184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleMode MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId WriteFile SetLastError GetCommandLineA GetFullPathNameW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc LoadLibraryW RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime LoadLibraryExW CompareStringW LCMapStringW GetStartupInfoW HeapReAlloc ReadFile ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx SetStdHandle HeapSize GetProcessHeap FlushFileBuffers IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetTimeZoneInformation SetEndOfFile WriteConsoleW RaiseException InitializeSListHead RtlPcToFileHeader TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwindEx FreeLibrary SetUnhandledExceptionFilter GetStdHandle CopyFileW FindNextFileW FindFirstFileW FindClose GetEnvironmentStringsW GetModuleHandleW GetCurrentProcessId GetProcAddress GetWindowsDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetLastError FreeEnvironmentStringsW GetSystemDirectoryW SetEnvironmentVariableW GetCurrentProcess GetCommandLineW CloseHandle GetFileInformationByHandle CreateFileW DeviceIoControl RtlCaptureContext GetModuleFileNameW

shlwapi

PathIsNetworkPathW

shell32

SHGetKnownFolderPath ord165

user32

MessageBoxW

bcrypt

BCryptCreateHash BCryptOpenAlgorithmProvider BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptFinishHash

crypt32

CertFreeCertificateContext CryptBinaryToStringW

msi

ord224

ole32

CoTaskMemFree

Name

.text

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

pservice.exe

IMPHASH 60e699a86ace77c1e6146e859c5513ec
SHA256 5a699a165838c739e449ac19a52e0a05b841bcee1a27f7d348f0dd04c8e277a3
MD5 46cd3fc327af9109bd143ba7f16df397
SHA1 53d2a6bcf0d21168050b852e287c2ef62f52f909
SHA512 d6e35f0dd4f6ef259dd7040d80cd469f27eb460836a4c767d40678ce82b46ce4c38b329c0cf3b41236cea2f0333f94669cfbef05ef484d91035f52ad4c1a5ca3
SSDEEP 6144:qaoZkv+B1x9heMY32Z4iZDzDJGjvGms7X5Hm:4Zkv+B1x9cMu2ZzS+msjZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

cd:84:b4:80:7a:9a:17:ce:31:d0:e4:38:41:6e:24:46:fa:3d:a3:43:2c:8d:63:21:9e:71:cd:44:13:a5:7c:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 24, 2023

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

93008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeleteFileW FindClose FindNextFileW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetCurrentThreadId QueryPerformanceCounter SetWaitableTimerEx CreateWaitableTimerW SetLastError GetFileType ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent HeapFree GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime LoadLibraryExW CompareStringW LCMapStringW GetFileAttributesExW HeapReAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle HeapSize GetProcessHeap IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW FlushFileBuffers WriteConsoleW RaiseException InitializeSListHead GetCommandLineA RtlPcToFileHeader TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwindEx GetConsoleMode FreeLibrary CreateProcessW SetUnhandledExceptionFilter GetStdHandle GetEnvironmentStringsW GetModuleHandleW GetCurrentProcessId GetProcAddress FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcess FindFirstFileExW GetCommandLineW GetExitCodeProcess ConnectNamedPipe QueryFullProcessImageNameW WTSGetActiveConsoleSessionId Process32FirstW Process32NextW GetLastError ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe GetNamedPipeClientProcessId CreateNamedPipeW WriteFile CallNamedPipeW ReadFile CloseHandle CreateFileW RtlLookupFunctionEntry GetModuleFileNameW

shlwapi

PathFileExistsW

shell32

SHGetKnownFolderPath

advapi32

RegQueryValueExW ReportEventW RegisterEventSourceW DuplicateTokenEx StartServiceCtrlDispatcherW CreateProcessAsUserW RegOpenKeyExW InitializeSecurityDescriptor OpenProcessToken RegSetValueExW SetServiceStatus SetTokenInformation RegCloseKey SetSecurityDescriptorDacl RegisterServiceCtrlHandlerExW DeregisterEventSource RegDeleteValueW

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

crypt32

CryptBinaryToStringW CertFreeCertificateContext

msi

ord224

ole32

CoTaskMemFree

sas

SendSAS

Name

.text

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

setup.json

SHA256 878dc7a5b708cbc7e9ab2465587c5a76f70b7e8bcbea871dde7583da6246940d
MD5 f4993c1cb73612115a9393e7f895a543
SHA1 550341774c8c36ff1ebd6194df8448013ebb9b80
SHA512 d73633e88f3cf504733b856b89a151a38d02f75a02b31684075b76344d72947353b0f70a14ebda03586a952fd6902a5d7734b0cd69382078e7bd85af6b9d6d0c
MD5 SHA1 SHA512

skel/appdata.json

SHA256 cd5d52066766b7f0fd7222e551a96c539f17c72debd32f8da9f76df4627a6dd5
MD5 2c669af7ee4adeddf72fa0102aa0378d
SHA1 5fcdf2480946eef8f55daa2df5522508e45deccd
SHA512 553caece520111cab22bb8e92099a2976acd7f2dc8c8766227f8d64259cc9e3104adf1b10019b25edb3a05b92a64afe5466c661f88bf33f2ecacda4fe6edc32f
MD5 SHA1 SHA512

skel/parsecd-150-93b.dll

IMPHASH 6894944ad194630e505136c343c64375
SHA256 b43debe8105cfd4e2c8f81599497ad4ad38640f19a64f9e530e7d2f64662bf6d
MD5 1ff3e1349edd37a206a97943731045c4
SHA1 6d1cfc0c0b26191385cb27149433e743b74d479a
SHA512 80f91692c22587e76e26c7ca38b267493d4598bce75e284b3fef4ef03c64ef8ba91d67bb7be2bddd9624e4aa52a67bdeb4b5eac3a86a31529bb18c44f5824fe6
SSDEEP 49152:UWvLIUXeaP9CAYaXaAndGk4L8jTMFv43/ruceDSbsRCy9uzY9eQoYVe0OUrVxkov:0I0jNdLrpEeD+vqBlMe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

33:90:c3:65:57:f4:0e:d8:c5:ed:56:88:8f:f1:ee:da:ff:9d:a7:2a:28:43:52:97:b7:cf:c2:42:ff:1a:06:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 29, 2024

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

1837788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose FindFirstFileW FindNextFileW CopyFileW MoveFileExW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetThreadId InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared GlobalSize ResetEvent WaitForSingleObjectEx LoadLibraryExW SetThreadErrorMode SwitchToThread GetFileAttributesW GetModuleHandleExW GetSystemTimeAsFileTime GetOverlappedResultEx ResumeThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery GlobalFree RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedFlushSList GetFileType WriteConsoleW GetFullPathNameW ExitProcess TerminateProcess GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread GetTimeZoneInformation RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent HeapFree HeapAlloc GetStartupInfoW FlsAlloc CreateWaitableTimerW FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW OutputDebugStringW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapReAlloc ReadConsoleW SetStdHandle HeapSize GetFileAttributesExW FlushFileBuffers IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW SetEndOfFile SleepConditionVariableSRW InitializeSListHead FindFirstFileExW GetThreadTimes InitializeCriticalSectionEx GetConsoleMode AttachConsole DeleteFileW SetWaitableTimerEx QueryPerformanceFrequency QueryPerformanceCounter GetConsoleWindow SetConsoleTitleW SetConsoleMode AllocConsole CreateProcessW GetStdHandle WideCharToMultiByte MultiByteToWideChar GetEnvironmentStringsW GetWindowsDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW FreeEnvironmentStringsW GetSystemDirectoryW SetProcessShutdownParameters SetEnvironmentVariableW GetCommandLineW SetPriorityClass CallNamedPipeW lstrlenW OpenThread TerminateThread GetComputerNameW GetExitCodeProcess SetEvent CreateThread Process32FirstW Process32NextW CreateToolhelp32Snapshot lstrlenA Sleep ConnectNamedPipe QueryFullProcessImageNameW GetNamedPipeServerProcessId GetOverlappedResult FormatMessageW DisconnectNamedPipe GetNamedPipeClientProcessId CreateNamedPipeW GetModuleFileNameW WriteFile SetLastError SetNamedPipeHandleState ReadFile AcquireSRWLockExclusive GetCurrentThread ReleaseSRWLockExclusive VerifyVersionInfoW VerSetConditionMask SetUnhandledExceptionFilter GetCurrentThreadId LocalAlloc GetTempPathW GetCurrentProcess GlobalUnlock GetModuleHandleW GlobalLock GlobalAlloc FreeLibrary GetProcAddress LoadLibraryW SetThreadExecutionState GetCurrentProcessId WTSGetActiveConsoleSessionId ProcessIdToSessionId CreateEventW GetCommandLineA LocalFree GetProcessHeap GetLastError OpenProcess WaitForSingleObject CloseHandle SetConsoleOutputCP GetFileInformationByHandle CreateFileW FlsGetValue DeviceIoControl

shlwapi

StrStrIW PathFileExistsW StrStrIA StrStrW PathIsNetworkPathW ord12

shell32

SetCurrentProcessExplicitAppUserModelID Shell_NotifyIconGetRect Shell_NotifyIconW DragAcceptFiles SHCreateDirectoryExW SHGetKnownFolderPath ExtractIconExW DragQueryFileW DragFinish

user32

MapVirtualKeyW GetPointerPenInfo GetPointerType GetKeyNameTextW IsZoomed IsIconic IsWindowVisible MonitorFromPoint CloseClipboard SetTimer OpenClipboard RegisterClassExW UnregisterClassW CreateWindowExW DestroyWindow DefWindowProcW EnumDisplaySettingsW PostMessageW ChangeDisplaySettingsExW InsertMenuItemW GetMonitorInfoW EnumDisplayMonitors GetRawInputData GetWindowPlacement CreatePopupMenu GetDoubleClickTime PostQuitMessage UnregisterHotKey RegisterHotKey RegisterRawInputDevices GetMenuItemInfoW GetRawInputDeviceInfoW EmptyClipboard GetClipboardData RemoveClipboardFormatListener GetClipboardSequenceNumber SetClipboardData AddClipboardFormatListener IsClipboardFormatAvailable KillTimer SetThreadDesktop CloseDesktop OpenInputDesktop GetSystemMetrics GetCursorInfo LockWorkStation DestroyMenu InsertMenuW TrackPopupMenu SetWindowPos DispatchMessageW PeekMessageW TranslateMessage RegisterWindowMessageW GetIconInfo DestroyIcon ShowWindow SendMessageW ClientToScreen GetAncestor GetWindowLongW EnumDisplayDevicesW SetForegroundWindow GetDC ReleaseDC GetWindowRect AdjustWindowRect SetCursorPos SetCursor GetCursor ScreenToClient ClipCursor EndMenu MonitorFromWindow GetWindowLongPtrW SetWindowLongPtrW GetClassLongPtrW LoadCursorW MessageBoxW CreateIconIndirect SetWindowPlacement GetClientRect WindowFromDC AllowSetForegroundWindow EnumWindows PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetMessageW SendInput GetKeyboardLayout GetAsyncKeyState wsprintfW GetWindowTextW QueryDisplayConfig DisplayConfigGetDeviceInfo SetDisplayConfig GetWindowThreadProcessId WindowFromPoint GetForegroundWindow GetCursorPos GetLayeredWindowAttributes SetLayeredWindowAttributes GetKeyState GetMessageExtraInfo

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ws2_32

sendto WSAPoll htons htonl recvfrom socket closesocket inet_ntop WSAGetLastError setsockopt ioctlsocket WSAStartup inet_pton getaddrinfo freeaddrinfo WSASendMsg WSASetLastError select bind WSAIoctl recv WSACleanup connect getnameinfo send ntohl ntohs inet_addr getsockname shutdown

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

imm32

ImmReleaseContext ImmDisableIME ImmSetCompositionWindow ImmGetContext

advapi32

RegQueryInfoKeyW RegGetValueW RegQueryValueExW GetUserNameW RegOpenKeyExW RegCloseKey InitializeSecurityDescriptor FreeSid SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl RegEnumKeyW GetTokenInformation QueryServiceStatusEx OpenServiceW ChangeServiceConfigW StartServiceW OpenProcessToken ControlService ChangeServiceConfig2W OpenSCManagerW CloseServiceHandle OpenThreadToken DuplicateTokenEx SetThreadToken LogonUserW IsWellKnownSid SetTokenInformation RegDeleteValueW RegSetValueExW GetNamedSecurityInfoW SetNamedSecurityInfoW RegOpenCurrentUser GetEffectiveRightsFromAclW CreateProcessAsUserW RegEnumKeyExW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSLogoffSession WTSQueryUserToken WTSConnectSessionW WTSQuerySessionInformationW

dxgi

CreateDXGIFactory2 CreateDXGIFactory1

winmm

timeEndPeriod timeBeginPeriod

dwmapi

DwmGetWindowAttribute

gdi32

GetObjectW CreateBitmap DeleteObject CreateDIBSection GetBitmapBits

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptDestroyKey BCryptGenRandom BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey

schannel

FreeCredentialsHandle InitializeSecurityContextW DeleteSecurityContext QueryContextAttributesW FreeContextBuffer AcquireCredentialsHandleW

secur32

EncryptMessage SetContextAttributesW DecryptMessage

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor GetScaleFactorForMonitor

crypt32

CertCreateSelfSignCertificate CryptUnprotectData CertStrToNameW CryptBinaryToStringA CertFreeCertificateContext CryptProtectData CryptBinaryToStringW

opengl32

wglGetCurrentDC glBindTexture glGenTextures glGetTexLevelParameteriv wglMakeCurrent wglDeleteContext wglCreateContext wglShareLists glDisable glTexImage2D glGetBooleanv wglGetProcAddress glEnable wglGetCurrentContext glGetIntegerv glFlush glDeleteTextures

xinput1_4

ord2 ord3

windowscodecs

WICConvertBitmapSource

d3d11

D3D11CreateDevice

d3d12

D3D12SerializeRootSignature ord101

hid

HidP_GetUsageValue HidP_GetButtonCaps HidP_GetCaps HidP_GetValueCaps HidP_GetUsages

cfgmgr32

SwDeviceCreate SwDeviceClose CM_Get_Device_Interface_PropertyW CM_Locate_DevNodeW CM_Get_DevNode_PropertyW CM_Get_DevNode_Status

msi

ord224

iphlpapi

FreeMibTable GetIfTable2Ex GetBestInterfaceEx GetIpAddrTable GetBestRoute GetAdaptersAddresses

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize PropVariantClear CreateStreamOnHGlobal GetHGlobalFromStream CoInitializeEx

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiSetClassInstallParamsW SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiSetDeviceRegistryPropertyW SetupDiGetDevicePropertyW SetupDiDestroyDeviceInfoList

winhttp

WinHttpWebSocketQueryCloseStatus WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSetStatusCallback

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=262, version=30795,

count=67, id=257, version=30795,

count=591, id=1, productName=Unmarked objects,

count=210, id=261, version=30795,

count=33, id=259, version=30795,

count=39, id=260, version=30795,

count=1, productName=Unmarked objects (old),

count=102, id=261, version=33030,

count=16, id=260, version=33030,

count=22, id=259, version=33030,

count=3, id=261, productName=VS2019 v16.8.2 build 29334, version=29334,

count=3, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,

count=21, id=260, version=31942,

count=12, id=260, productName=VS2017 v15.3.3 build 25507, version=25507,

count=1, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=132, id=260, productName=VS2019 v16.8.2 build 29334, version=29334,

count=10, id=110, productName=VS2005 build 50727, version=50727,

count=53, id=260, version=33133,

count=120, id=264, version=33133,

count=1, id=256, version=33133,

count=1, id=255, version=33133,

count=2, id=151,

count=1, id=258, version=33133,

teams.exe

IMPHASH ca031310eb12b349b9b999ebbe0436d0
SHA256 6dc71b2e92b770dcfeca4a32c8f1787210311f731f1124754df193ec22d5d13e
MD5 faa24223985abfbf64e4ddcd43f062d3
SHA1 e1374dc7c98405efc5a44aa3229b97eabdd69bb2
SHA512 23324afcb51508f5ea3f120a5787b150a8226d677c5a55fef219674b4d619fd0d7300d2b4cad917864d5f54788b9c8546db2a77aa4f0d666a956014169c4a6c9
SSDEEP 6144:GAR9duE83BYjyEbU1SDgFg8EwkSdbAxD22y6jvGmp:H9gp3WjyEbU1SDAgJw40c+mp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

67:b5:9b:6e:bc:29:7b:91:a1:a0:a2:cf:43:ff:50:7a:7f:37:f2:e0:ec:6c:a3:e4:2c:ea:f4:cd:42:fe:f2:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 22, 2022

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0f:f5:0e:15:d1:d2:93:3d:fe:2a:27:b8:df:b2:5e:5e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2020 - Apr 26, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

29760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsProcessorFeaturePresent GetCurrentThreadId ExitProcess FreeLibrary GetModuleHandleW GetModuleHandleExW GetProcAddress GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime LoadLibraryExW CompareStringW LCMapStringW MultiByteToWideChar GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead GetCurrentProcess SetUnhandledExceptionFilter TerminateProcess GetCurrentDirectoryW CreateFileW FindClose FindNextFileW CloseHandle GetStdHandle GetModuleFileNameW UnhandledExceptionFilter GetConsoleMode WaitForSingleObject InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive SetWaitableTimer CreateWaitableTimerW RtlUnwindEx EncodePointer RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader WriteFile GetFileType WriteConsoleW OutputDebugStringW FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadFile ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FlushFileBuffers SetEndOfFile IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCommandLineW GetCommandLineA SetLastError GetLastError GetComputerNameW LocalFree

crypt32

CryptProtectData

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetTimeouts WinHttpOpen WinHttpConnect

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vusb/parsec-vud.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 dfb4463aeacba1153cc4a63bdec82ded73a788a2797d62003d3da0d330207e2e
MD5 3cdb48df5ecd5ed2c102fb2edb20492a
SHA1 4d8309a4d7222f98abb2d8bb8b29fc35a0509831
SHA512 0c5a3ffc35a7abc66e13c89fb166b78b6d5f3c8a36b44b9bbfc2691ad884d8b77fe2fc7857c52bb0636abfde2657613e46828a6f5feb97977e410c46db27b000
SSDEEP 3072:IbG7N2kDTHUpouC0NIHo0Ym9eyOEebifyUPNqF+jgi1ZTt:IbE/HU60uI0YAOEe2fyU9jgIpt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

.data

SHA256 05429ca22a1221b4c12a26881799b71b769633a366bccd17b0114acd29ac162f
MD5 82a10c59a8679bb952fc8316070b8a6c
SHA1 7e347dcff055b97091b833896e1097b7ed374fdd
SHA512 baaedbfee3b4006383e134ce1776a03bc709bf484c3633910dc6f3b976214cf44e84fc14bb3e0801ce4ec4007954ef2a9a4f9d5b9ee85052156b8c9e578b4e56
MD5 SHA1 SHA512

.rdata

SHA256 322668435dbcf8d7246f9f554db08e811dd251f45ad883764e7af6b723e51e0a
MD5 a118375c929d970903c1204233b7583d
SHA1 73c2bec231377068f99d5c55ff5c975960280e6c
SHA512 8813707d2244491752ab9e7a54cceb7ab5e0e531b03a3cc9c7e6b3cebed4b36774877dc0bb8907d55cf89e47b7be6741c45d65dd3bcd4a9c9c19a506f4837b29
SSDEEP 96:G8UlBrMl8xCav/omsO8UlFJdlTnDPhxyPYPkcmkJqiyxBjKwrD:72rLzopzUFnDLyPYyk81jKG
MD5 SHA1 SHA512 SSDEEP

.rsrc/DIALOG/105

SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014
MD5 386770584473e271f23dced36427f4ff
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19
SHA512 e7bd459dc14642e2222477a05694db86e526c90333a6e0e711c91a8d5893036c09a27f75855d2b416f3da4ecb59e7a466d82b7cb7abdd56f6dabb040da34c1f3
MD5 SHA1 SHA512

.rsrc/DIALOG/106

SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA512 d97885f9c2846a042ec3c0d01a756d22fda7a989d55cd61efbc945abcdcfd74ca0284c745cf8bebf2d2fab82718f7b57ab0b701f67d2319ca6b5f55bce663c07
MD5 SHA1 SHA512

.rsrc/DIALOG/111

SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763
MD5 1db3e4c32b9560257ddf3506fef9dd3f
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673
SHA512 ab76d465e4285a156a877760231a39d168310f48df2bab925b33078938ac43899219a5c9f090f6b3509f4a4b2da60a281209b031e18185171d7b7d5dbeb1a851
MD5 SHA1 SHA512

.rsrc/GROUP_ICON/103

SHA256 a948c568e391e68f0c8e4ff8cd63b8d1a327636e0874de27dbb23928ee356f55
MD5 51184436840d3ae0465d76c7f0ba5368
SHA1 705532f76805d874604645ad9ad62063262d0d0b
SHA512 6a93a0433da15b586921865f054d9b23dcfbf8576ed24e556e2bbfcf58a3150783bfc0de8fb1f6ad1e4f919019a64818716f5bbd5fc03aaa66cd8a55d275ab09
MD5 SHA1 SHA512

.rsrc/ICON/1

SHA256 cb7173333436abebf8c8e9f3d74c269f90844f8436c869ed88aed85dc3fa927f
MD5 1c35740fe89722ba93cfc7afa6020fb8
SHA1 26f76047d83523e9ad308cf16c2805d80e3227c1
SHA512 4ec95dec3c89b1ac6bea9b1cd8688828c538994fb98686dd8c5066b997252125cef09a1fe3487c78031f707e47ffbd479182144100c549ae9c8e588699b4b35a
SSDEEP 768:8q4KK/EazcTbpIH+2Efv0wPVY1f8CHeUAL24FQX2xy:8vhzSNIHo0YmkCHey4Foiy
MD5 SHA1 SHA512 SSDEEP

.rsrc/MANIFEST/1

SHA256 a01b1e9b03ff72f72efff34927cef73a3e6f6b7e2beed90120cbde3ad41de1f0
MD5 5ee6190e98bb9546fc0551de48610550
SHA1 dd7f27311a739a7ccf8222c022f631361240c3b9
SHA512 cbbd4db5a8f61ac08bb578f96e23aa6e6b1e225e99f29eab3e87031854335d3be13d7504c724244a0507b5d2deb9da14f9e551aa9e60135abd36fa55d5ef9713
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 92db6bc93c989fa5dd46cd73d810d322ddd09b7bcb97835ea926fcb8869afc62
MD5 c2a02c808b6d1d202b1bf900bec5b329
SHA1 782ff181adcebcbd440d9532b3ecf7df59f0b1db
SHA512 25397622706e81448eeed4c862879b02922dbdb787285d9b25d934d3511b5898a4ba150b0f8c7fc32fcb0b8f9ad863347f1d6c3b60b77df3539d26e647a9fe2a
MD5 SHA1 SHA512

.text

SHA256 c902047f3976f37a722b89e3e2401d690d77b3e70ebaf7a32e9ac5ce6ff34a5e
MD5 ce9df19df15aa7bfbc0a8d0af0b841d0
SHA1 6cba022a30ad3c84a5343e05a15e49562c18aba0
SHA512 3ceeb63113e6e3c6c0031348cb4d49d58b54bdfc46e7b4d6d39b2dc29549d293d1e2df988db5ff2aeeb8831bc5f49667528c076fe3da30c19890e1fd743d68d6
SSDEEP 768:N7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3:4/T2X/jN2vxZz0D
MD5 SHA1 SHA512 SSDEEP

[0]

SHA256 80a44c3c13e43ffd6a916187cfd9b0de62ac63b3bc370ea1e0ba6181d72db600
MD5 ea7dc26e496f91f554522c8fc2f51b65
SHA1 ed8acc408941bf7a4b420499b4b2ee4545788be0
SHA512 db11e6a26cb9d08f2fb2ed66c604140e0b00327b9d2b2df3e8598dc1263a83609a4e5f3faebad467c0391012e215db75764a48d2c5e3bb02ce5513dc90989df0
SSDEEP 768:62KOsi+81Vxh6pn/MIgnCJsH1qVDEqF90dsHpgrr1RUF46+1esXIcafIQCa5Pe:6nOsi+81yUxE+1oYqF+dsH61GF4R1esB
MD5 SHA1 SHA512 SSDEEP

wscripts/firewall-add.vbs

SHA256 0be5aa5cc6395a86878f56b131e13db4908e48f06e892ff8f8cf9e2d3b6c8abb
MD5 882374285898f16b5f9ff44afc1ae701
SHA1 31c9445557c9b8ecda1f0a6d5ff666e01dd1c3ca
SHA512 3b05158b03b57a4d2cbfee9cef6adfe973d080264a88e5cdeb85c59b567529cd1cd2a3b5d8538cb8637d140fd8691dc8826388ab669b7bfb2d5c1c4174069243
MD5 SHA1 SHA512

wscripts/firewall-remove.vbs

SHA256 75f1dece4fda689a907f6d74b513adb0c1771c1b79ea71160179542c9c4ab2f0
MD5 5d4d70cdf36fcdaa292da1da9133320c
SHA1 92dc18d3d1128d43f482ab56804136c687b00713
SHA512 b54c92fbecb10ddf66d1b7ad950ffbc13f504c71081a8bd56c28c5689a2bf19bd81b467e0697c38f140c72a273eb9eb837105e738c6f1ac4f43344e2ab521778
MD5 SHA1 SHA512

wscripts/legacy-cleanup.vbs

SHA256 dea38bd553abe93c689de42d0220add18f9be3e3d2fa53f97eb8649f586df4f3
MD5 c78520c3162c1962f3164714b37eb4d0
SHA1 67c19b8aea7ad99465976dbcd3efcfdd7d62e3fe
SHA512 cfbfc2c7dd8019f98b77e8881680ef9d0135a210fb9b0136a4992c236d971e247aa1641cd2eafdc5f6f5bb61002b30ea14b226127c4cef04f3b3d6be3a941fcc
MD5 SHA1 SHA512

wscripts/service-install.vbs

SHA256 01f62a12de3307b375dff3ebcd6961d76ffcbc24f70682c7875655a811ce76a1
MD5 971e2a344a6e17347a81eeb21ada7ba7
SHA1 37e034c29adda9b118b75bfdc7c6f41aac71e257
SHA512 5ea0750dc07ff1a0eb1807043b48fb9ed54f6dcb96ce03cb543b0ea36d326779814b6cb87091373574911662a35d75b576e35c5b8d781db36fe1503f8287c65d
MD5 SHA1 SHA512

wscripts/service-kill-parsec.vbs

SHA256 71f9cc28497b959377439f6611615ef582745dd5b9cca02b5c4b24bb1fc3dfb8
MD5 f7b0c63e7aea5cbd96f7bf1021b28b73
SHA1 fc5b11a6bf022740de3ba15455b06ad3f061366b
SHA512 c957b7b45b188af0b6e6698507e94564e8e5ccc8dbf5f0237827df373878291095887422584f7f3b7833cbcdd682531fa75c974ba1137031b32bf2ffba268191
MD5 SHA1 SHA512

wscripts/service-remove.vbs

SHA256 970b3c2a9ea1906a177810990478932e3517f47aba267cf2ab9e4ba65e7b475f
MD5 b90e75dd7903cb2d6328bb3714865c7a
SHA1 2d32868deb198726ed5feb80b66542bad7fbacee
SHA512 3d4bfb86ec98fd85843ae5b63dcf5f475c6500380f02bb4d0dee15a5f7e2334abdbbcd9420b8ac05b5beb8a63b9ea16abcd70ae01c04b87a423fc288ff4dca0a
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

parsec-windows.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/ApplicationID.dll

kernel32

shell32

ole32

shlwapi

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

parsecd.exe

kernel32

shlwapi

shell32

user32

bcrypt

crypt32

msi

ole32

generic

pservice.exe

kernel32

shlwapi

shell32

advapi32

wtsapi32

crypt32

msi

ole32

sas

generic

setup.json

skel/appdata.json

skel/parsecd-150-93b.dll

kernel32

shlwapi

shell32

user32

userenv

ws2_32

version

imm32

advapi32

wtsapi32

dxgi

winmm

dwmapi

gdi32

bcrypt

schannel

secur32

api-ms-win-shcore-scaling-l1-1-1