parsec-windows[.]exe

resource
unpack001/$PLUGINSDIR/ApplicationID.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsExec.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$PLUGINSDIR/nsExec.dll

parsec-windows.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 b8a9cd519010666def0ef6e119eb42b33b5b811216f34e4f6c8e2e25ac290fbc
MD5 50847efa95d0d1062777c6af8285c425
SHA1 ff7f99cf99c4438cd0b930157fa121b9699695cc
SHA512 993b26b4d1b39c064bd1eb4bddb442d52feff72daacde51e17ce61abc8f1b7a0445a8de17d1a39555916779c8e49e64786454c8c73c845e11d5ccb7aa647f775
SSDEEP 98304:b9+nof7+RYaPtNRgb/A+0gCzt2J34phK5C10Ny:b9+n4nKPRg8oCw3Eqk
TLSH
T1431633B7A9F0F131D8A202BD4F68DF1E06E2BD5B2ADB57B7A71031481235D828A4C577
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c6:87:a9:f4:c0:7c:7a:f2:83:73:bb:eb:e9:f1:1b:d9:9a:7f:77:c8:e0:3a:7b:58:4b:b6:bf:3c:f6:b4:8b:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Chains

Jun 23, 2026

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Serial Number

08:af:a0:0f:8f:60:47:bf:d6:90:7f:b9:f0:74:49:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2025 - May 12, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/ApplicationID.dll

IMPHASH 9b38d46d6882ee63437c721734be794c
SHA256 1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4
MD5 a858c1a57e32485505b1977cf0a125be
SHA1 25d86c4b51f7cc10fc70e3a0493a39c4460cc350
SHA512 32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d
SSDEEP 3072:2pBNN6AmU9cDlKd3P6V9nSm49WTgKg4Fa1V3FuXRAuAg0FubA9cVsL+73:2pzxmQ3yL+9MgKbxAOEXY
TLSH
T1B9147D10B491C472D1BF16340979ABA15B3CBD600BA89AEFA7D84D6E4F781C06B31B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

33165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\src\NSIS-ApplicationID\Release\ApplicationID.pdb

kernel32

MultiByteToWideChar GlobalAlloc GlobalFree lstrcpynA WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException GetLastError FreeLibrary LoadLibraryExW InterlockedFlushSList HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetStdHandle GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize CreateFileW

shell32

SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName

ole32

CoCreateInstance CoInitialize CoUninitialize

shlwapi

SHStrDupW

Name

.text

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

parsecd.exe

IMPHASH 73c5bb8918ce08d3d349931d433b45ab
SHA256 e1181c0ee31fb49e19038081c111387fc70be880fa1e3a783e6ec62004c5b4e0
MD5 2a6b810971b984cfd38be91ebbf5eabf
SHA1 6fc949cee6fffe7a66b24e633099485249427e48
SHA512 dd9b8a47ced70671f742fe91f30f6d65c26ee27a1412e4ea1edfbebe3d826f9b7d5756a142404fd42f093b13353860d6cd7d219f34d857acc1ee3eb68c481a6d
SSDEEP 6144:g4y4ocWCbt3nLSWoWe2A5YN2+ym0osCNVZNy/2KjvGms7X5IC:i9k9nLOzfYN2+yH1cVZNyuM+msjGC
TLSH
T17BB4287BB2E5B4B4D4A2827D8F14861DD6E13C1317D387BB2360736A2A23E81493D677
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f8:c0:e4:ef:29:58:aa:1f:f6:f8:bb:36:43:ca:f0:91:70:99:7f:7e:af:0d:8f:57:ec:40:6a:ff:cb:8b:01:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Chains

Jun 16, 2026

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Serial Number

08:af:a0:0f:8f:60:47:bf:d6:90:7f:b9:f0:74:49:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2025 - May 12, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

169148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\native-release\native-release\parsec\build\parsecd.pdb

kernel32

FreeLibrary LoadLibraryW GetConsoleMode MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId GetFullPathNameW GetCommandLineA ExitProcess TerminateProcess GetModuleHandleExW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapAlloc RtlCaptureContext SetUnhandledExceptionFilter RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent HeapFree GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect LoadLibraryExW CompareStringW LCMapStringW HeapReAlloc GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW SetStdHandle RaiseException FlushFileBuffers HeapSize HeapQueryInformation GetProcessHeap IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetTimeZoneInformation WriteConsoleW SetEndOfFile InitializeSListHead RtlPcToFileHeader TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwindEx GetStdHandle DeleteFileW GetEnvironmentStringsW GetModuleHandleW GetCurrentProcessId GetProcAddress GetWindowsDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW GetCurrentThread SetProcessMitigationPolicy FreeEnvironmentStringsW GetSystemDirectoryW FindFirstFileExW SetEnvironmentVariableW GetCommandLineW FindClose GetCurrentProcess FindNextFileW FindFirstFileW CopyFileW GetLastError GetModuleFileNameW WriteFile SetLastError ReadFile LocalFree CloseHandle GetFileInformationByHandle CreateFileW RtlLookupFunctionEntry DeviceIoControl

shlwapi

PathFileExistsW PathIsNetworkPathW

shell32

SHGetKnownFolderPath ord165

user32

MessageBoxW

advapi32

InitializeSecurityDescriptor FreeSid SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl AddAccessAllowedAce SetSecurityDescriptorControl GetLengthSid InitializeAcl GetFileSecurityW OpenProcessToken AddAce GetSecurityDescriptorControl SetNamedSecurityInfoW EqualSid GetAce GetAclInformation SetFileSecurityW GetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation OpenThreadToken IsWellKnownSid

bcrypt

BCryptOpenAlgorithmProvider BCryptHashData BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCreateHash

crypt32

CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain

ole32

CoTaskMemFree

Name

.text

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

pservice.exe

IMPHASH fa750c374f75846f11b8a8ecf78f46c2
SHA256 566f3dfd079b1c3129aae68645f0005a869544078aa86b0a14864a36ad7aa9cf
MD5 caf28164339526deddce7a329974f8dd
SHA1 27fea5b3bcdd3fa2c10d1f0a5e76af1840d97678
SHA512 16302a8394aeb0025cc4deb72e255e573fb41e595a7ef8ede31409084d24e4ed28c57a1ee706536287d9c8de204b0ddcfecdb904d6bb11a21b44ae0878ae67cc
SSDEEP 3072:NQBE7Bj5dl6BAxLGGIvUNUzudpVovaE9aMU+DxJ8U9Ug1+UTvGmRe8wn7slKT5+r:Ns6j3IBADI0u5eU9Ug1jvGms7X5I
TLSH
T1829418BB32E5B4F4D4A2827D8F50861D96E23C131BD347BB2260733A5E32E81592D677
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

71:d1:dc:66:29:c8:5d:e1:4b:60:59:25:dc:cc:8a:e1:a0:40:19:a5:a0:f4:50:4d:65:fb:67:1d:96:e2:c3:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Chains

Jun 3, 2026

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Serial Number

08:af:a0:0f:8f:60:47:bf:d6:90:7f:b9:f0:74:49:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2025 - May 12, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

105044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\native-release\native-release\parsec\build\pservice.pdb

kernel32

DeleteFileW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetCurrentThreadId QueryPerformanceCounter SetWaitableTimerEx CreateWaitableTimerW SetLastError GetFullPathNameW GetDriveTypeW GetFileType ExitProcess TerminateProcess GetModuleHandleExW RtlCaptureContext RtlLookupFunctionEntry IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileAttributesExW HeapReAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle FlushFileBuffers RaiseException HeapSize HeapQueryInformation IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW WriteConsoleW InitializeSListHead GetCommandLineA RtlPcToFileHeader TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwindEx GetConsoleMode FreeLibrary SetUnhandledExceptionFilter GetStdHandle FindClose FindNextFileW GetEnvironmentStringsW GetModuleHandleW CreateProcessW GetCurrentProcessId GetProcAddress GetCurrentDirectoryW FreeEnvironmentStringsW FindFirstFileExW SetEnvironmentVariableW GetCurrentProcess GetCommandLineW GetExitCodeProcess ConnectNamedPipe QueryFullProcessImageNameW GetProcessHeap WTSGetActiveConsoleSessionId HeapAlloc Process32FirstW Process32NextW GetLastError ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe GetNamedPipeClientProcessId CreateNamedPipeW WriteFile HeapFree CallNamedPipeW ReadFile CloseHandle GetFileInformationByHandle CreateFileW DeviceIoControl RtlVirtualUnwind GetModuleFileNameW

shlwapi

PathFileExistsW PathIsNetworkPathW

shell32

SHGetKnownFolderPath

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl GetTokenInformation RegQueryValueExW ReportEventW RegisterEventSourceW DuplicateTokenEx StartServiceCtrlDispatcherW CreateProcessAsUserW RegOpenKeyExW OpenProcessToken RegSetValueExW SetServiceStatus SetTokenInformation EqualSid RegCloseKey RegisterServiceCtrlHandlerExW DeregisterEventSource RegDeleteValueW

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

crypt32

CryptBinaryToStringW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData

ole32

CoTaskMemFree

sas

SendSAS

Name

.text

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

setup.json

SHA256 79e608e6eabc337b047ff0c44f8098f2e6170f0d8d59fab39e10c089ac0f3d6d
MD5 9e2f6ce3148593bb25fd6725967b446b
SHA1 d566b37006bc817d066bbe7e332f699ae296d8b3
SHA512 cab70498ed2de662d1d735f6a0d550bdb02d07ee0d036fb4e4e4bb549fcb141ba343e7463ed6f829bea8227f0ab9c46e11999632a113a299b5e6ff976ac2213b
MD5 SHA1 SHA512

skel/appdata.json

SHA256 87db899dd3399f84f64301a3b65d71b4bc55f74fddfff3727d83533f258e5c4d
MD5 d4f42154144ed074eaa879bac72b2201
SHA1 8142615b14824df1ebf640b4b0ae07d6ec6a3cbf
SHA512 cb3daef0f346beb25e14fa7f8a7c9550fa054916c18fb81ac013cc4d1c1d99f5a07f20884114bad55f38cedc739b8073e1483bdfc006150556f4b2d9048bd94d
TLSH
T1B8C08CA18004482B80E2A1CA4890ACA6D2390E0B20701A0235782BED8F61A330042B06
MD5 SHA1 SHA512 TLSH

skel/parsecd-150-104a.dll

IMPHASH 11471e82baabf092dbb980b2e39fe455
SHA256 8c8c4299ddf503b2c25c0905b0a0820f3e8238c252e9ace37bf25964ef4a8f6f
MD5 9d822ea0a064147ab5a88f8ad01b3193
SHA1 7d8ebac3b2848f0dd5a7661816290c3250758b5c
SHA512 08690a3f50a894ab315fe0c5f6f94d5bd1d639b329276c42e5b325d581c0ef1116589792cc5948bb54493295b7e798b7aafd0673be11c3f8115c97fe50700cae
SSDEEP 49152:hgrPRiNAwlgvLJhhHdMSNkvGPVezddRQusF1YaVRKGxnkBeU/TTlzlAuCq3fWCC5:h2faPeaBz0ocUzKEQ
TLSH
T14D569D3763E511B8C66681388F07531BE6B17C4617F197EB02E456692F63FE00ABA732
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Digest

cd:55:e3:80:21:cd:f9:8f:32:96:5a:4e:7c:50:59:98:71:f7:3f:1b:b1:71:71:34:ba:af:97:1d:f0:c9:54:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Chains

Jun 16, 2026

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US

Serial Number

08:af:a0:0f:8f:60:47:bf:d6:90:7f:b9:f0:74:49:bf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2025 - May 12, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

2307908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\native-release\native-release\parsec\build\parsecd-150-104a.pdb

kernel32

GetThreadId InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared GlobalSize SetWaitableTimer ResetEvent WaitForSingleObjectEx SetThreadErrorMode LoadLibraryExW SwitchToThread GetEnvironmentVariableA GetEnvironmentVariableW GetFullPathNameW HeapAlloc HeapFree GetTickCount64 GetSystemTimeAsFileTime GetFileAttributesW ResumeThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery WaitForMultipleObjects GlobalFree RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedFlushSList GetFileType DeleteFileW ExitProcess GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetConsoleCtrlHandler ExitThread SleepConditionVariableCS GetTimeZoneInformation GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW HeapReAlloc GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW SetStdHandle HeapSize HeapQueryInformation FlushFileBuffers GetFileAttributesExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW SetEndOfFile SleepConditionVariableSRW InitializeSListHead LeaveCriticalSection SetWaitableTimerEx QueryPerformanceFrequency QueryPerformanceCounter GetConsoleWindow SetConsoleTitleW EnterCriticalSection SetConsoleOutputCP SetConsoleMode GetConsoleMode AttachConsole AllocConsole GetStdHandle WideCharToMultiByte NormalizeString MultiByteToWideChar GetEnvironmentStringsW CreateProcessW GetWindowsDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW UpdateProcThreadAttribute SetProcessMitigationPolicy FreeEnvironmentStringsW GetSystemDirectoryW CreateJobObjectW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable DeleteCriticalSection FreeLibraryAndExitThread SetProcessShutdownParameters SetEnvironmentVariableW InitializeProcThreadAttributeList AssignProcessToJobObject SetPriorityClass CallNamedPipeW SetInformationJobObject DisableThreadLibraryCalls GetCommandLineW lstrlenW FindClose FindNextFileW FindFirstFileW OpenThread TerminateThread GetComputerNameW SetEvent GetLastError RtlCaptureStackBackTrace GetModuleHandleExW CreateThread Process32FirstW Process32NextW CreateToolhelp32Snapshot lstrlenA ConnectNamedPipe QueryFullProcessImageNameW GetOverlappedResultEx GetNamedPipeServerProcessId GetOverlappedResult FormatMessageW DisconnectNamedPipe GetNamedPipeClientProcessId CreateNamedPipeW WriteFile SetLastError SetNamedPipeHandleState ReadFile GetExitCodeProcess GetModuleFileNameW TerminateProcess AcquireSRWLockExclusive GetCurrentThread ReleaseSRWLockExclusive VerifyVersionInfoW VerSetConditionMask SetUnhandledExceptionFilter GetCurrentThreadId GetTempPathW GetCurrentProcess GlobalUnlock GetModuleHandleW GlobalLock GlobalAlloc SetThreadExecutionState GetCurrentProcessId WTSGetActiveConsoleSessionId ProcessIdToSessionId CreateEventW FreeLibrary GetProcAddress LoadLibraryW Sleep GetProcessHeap OpenProcess WaitForSingleObject LocalFree CloseHandle GetFileInformationByHandle CreateFileW LocalAlloc InitializeCriticalSection MoveFileExW CreateWaitableTimerW CopyFileW DeviceIoControl WriteConsoleW DecodePointer CompareStringEx LCMapStringEx TryAcquireSRWLockExclusive GetCommandLineA FindFirstFileExW

shlwapi

StrStrIA PathFindFileNameW StrStrIW PathFileExistsW StrStrW PathIsNetworkPathW ord12

shell32

ord165 SetCurrentProcessExplicitAppUserModelID Shell_NotifyIconGetRect Shell_NotifyIconW DragAcceptFiles DragFinish DragQueryFileW ExtractIconExW SHGetKnownFolderPath SHCreateDirectoryExW

user32

GetWindowLongW AllowSetForegroundWindow GetShellWindow wsprintfW GetWindowTextW EnumWindows RegisterDeviceNotificationW GetWindowThreadProcessId WindowFromPoint GetForegroundWindow GetCursorPos GetLayeredWindowAttributes SetLayeredWindowAttributes GetKeyState GetMessageExtraInfo GetAsyncKeyState GetKeyboardLayout SendInput GetMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW UnregisterHotKey MapVirtualKeyW GetIconInfo RegisterWindowMessageW RegisterHotKey PostQuitMessage EnumDisplaySettingsW WindowFromDC GetClientRect PostMessageW DisplayConfigGetDeviceInfo SetDisplayConfig DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW OpenClipboard SetTimer CloseClipboard GetAncestor GetDoubleClickTime SetWindowPos GetWindowPlacement SetWindowPlacement IsWindowVisible IsIconic IsZoomed GetKeyNameTextW GetPointerType GetPointerPenInfo CreatePopupMenu DestroyMenu InsertMenuW TrackPopupMenu EndMenu InsertMenuItemW GetClipboardData RemoveClipboardFormatListener GetClipboardSequenceNumber SetClipboardData AddClipboardFormatListener IsClipboardFormatAvailable GetMenuItemInfoW KillTimer SetThreadDesktop CloseDesktop OpenInputDesktop GetSystemMetrics GetCursorInfo LockWorkStation DispatchMessageW PeekMessageW TranslateMessage EnumDisplayDevicesW SetForegroundWindow GetDC ReleaseDC GetWindowRect AdjustWindowRect SetCursorPos SetCursor ClientToScreen SendMessageW ShowWindow EmptyClipboard GetCursor ScreenToClient ClipCursor GetClassLongPtrW LoadCursorW CreateIconIndirect MonitorFromPoint MonitorFromWindow GetMonitorInfoW EnumDisplayMonitors DestroyIcon GetRawInputData RegisterRawInputDevices MessageBoxW GetRawInputDeviceInfoW GetWindowLongPtrW SetWindowLongPtrW QueryDisplayConfig

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ws2_32

getsockname inet_addr sendto WSAPoll htons inet_ntop recvfrom socket closesocket bind WSAGetLastError setsockopt ioctlsocket send WSAStartup WSAIoctl freeaddrinfo getaddrinfo htonl WSASendMsg WSASetLastError shutdown getnameinfo connect recv select ntohs ntohl WSACleanup inet_pton

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmDisableIME ImmGetContext

advapi32

CreateProcessAsUserW TraceMessage InitializeSecurityDescriptor FreeSid SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl RegQueryValueExW GetUserNameW RegOpenKeyExW RegCloseKey RegEnumKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle GetTokenInformation ChangeServiceConfigW StartServiceW OpenProcessToken ControlService ChangeServiceConfig2W AddAccessAllowedAce SetSecurityDescriptorControl GetLengthSid InitializeAcl GetFileSecurityW AddAce GetSecurityDescriptorControl SetNamedSecurityInfoW EqualSid GetAce GetAclInformation SetFileSecurityW GetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyExW RegDeleteKeyW OpenThreadToken DuplicateTokenEx SetThreadToken LogonUserW IsWellKnownSid SetTokenInformation GetTraceEnableFlags GetNamedSecurityInfoW RegOpenCurrentUser GetEffectiveRightsFromAclW EventWriteString EventUnregister EventRegister RegGetValueW RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel

wtsapi32

WTSConnectSessionW WTSEnumerateSessionsW WTSLogoffSession WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateProcessesExW WTSQueryUserToken

dxgi

CreateDXGIFactory2 CreateDXGIFactory1

winmm

timeEndPeriod timeBeginPeriod

dwmapi

DwmGetWindowAttribute

gdi32

GetObjectW GetBitmapBits CreateDIBSection DeleteObject CreateBitmap

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptDestroyHash BCryptHashData BCryptGenerateSymmetricKey BCryptFinishHash BCryptCreateHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptEncrypt BCryptSetProperty

schannel

FreeCredentialsHandle InitializeSecurityContextW DeleteSecurityContext QueryContextAttributesW FreeContextBuffer AcquireCredentialsHandleW

secur32

EncryptMessage SetContextAttributesW DecryptMessage

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor GetDpiForMonitor

crypt32

CertStrToNameW CertCreateSelfSignCertificate CertFreeCertificateContext CryptUnprotectData CryptProtectData CryptBinaryToStringW CryptBinaryToStringA

xinput1_4

ord2 ord3

windowscodecs

WICConvertBitmapSource

d3d11

D3D11CreateDevice

d3d12

ord101 D3D12SerializeRootSignature

hid

HidP_GetValueCaps HidP_GetUsageValue HidP_GetUsages HidP_GetButtonCaps HidP_GetCaps

cfgmgr32

SwDeviceCreate SwDeviceClose CM_Get_DevNode_Status CM_Get_DevNode_PropertyW CM_Locate_DevNodeW CM_Get_Device_Interface_PropertyW CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW CM_Locate_DevNode_ExW CM_MapCrToWin32Err CM_Unregister_Notification CM_Register_Notification CM_Reenumerate_DevNode_Ex

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust

newdev

DiInstallDevice DiUninstallDevice

iphlpapi

GetIfTable2Ex FreeMibTable GetAdaptersAddresses GetBestInterfaceEx

ole32

CoUninitialize PropVariantClear CoInitialize StringFromGUID2 CoInitializeEx CreateStreamOnHGlobal GetHGlobalFromStream CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoCreateFreeThreadedMarshaler

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiSetClassInstallParamsW SetupDiGetDeviceInstanceIdA SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyA SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceInterfaceDetailW SetupDiCreateDeviceInfoList SetupDiOpenDeviceInfoW SetupDiGetClassDevsA SetupDiSetSelectedDevice SetupDiSetDeviceInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiGetDevicePropertyW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

winhttp

WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpWebSocketQueryCloseStatus WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle WinHttpConnect

oleaut32

SysFreeString GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=262, version=33145,

count=67, id=257, version=33145,

count=606, id=1, productName=Unmarked objects,

count=215, id=261, version=33145,

count=35, id=259, version=33145,

count=47, id=260, version=33145,

count=14, id=259, version=35207,

count=16, id=260, version=35207,

count=87, id=261, version=35207,

count=3, id=261, productName=VS2019 v16.8.2 build 29334, version=29334,

count=9, id=260, version=34120,

count=3, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,

count=1, id=260, version=33133,

count=21, id=260, version=31942,

count=13, id=260, version=34433,

count=1, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=135, id=260, productName=VS2019 v16.8.2 build 29334, version=29334,

count=17, id=261, version=35211,

count=44, id=260, version=35227,

count=153, id=264, version=35227,

count=1, id=256, version=35227,

count=1, id=255, version=35227,

count=2, id=151,

count=1, id=258, version=35227,

teams.exe

IMPHASH ca031310eb12b349b9b999ebbe0436d0
SHA256 6dc71b2e92b770dcfeca4a32c8f1787210311f731f1124754df193ec22d5d13e
MD5 faa24223985abfbf64e4ddcd43f062d3
SHA1 e1374dc7c98405efc5a44aa3229b97eabdd69bb2
SHA512 23324afcb51508f5ea3f120a5787b150a8226d677c5a55fef219674b4d619fd0d7300d2b4cad917864d5f54788b9c8546db2a77aa4f0d666a956014169c4a6c9
SSDEEP 6144:GAR9duE83BYjyEbU1SDgFg8EwkSdbAxD22y6jvGmp:H9gp3WjyEbU1SDAgJw40c+mp
TLSH
T1BD7429BB72E478F4E4A2423D8F11860DD6F17C1346D38BBB229072669E23E905D29777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

67:b5:9b:6e:bc:29:7b:91:a1:a0:a2:cf:43:ff:50:7a:7f:37:f2:e0:ec:6c:a3:e4:2c:ea:f4:cd:42:fe:f2:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 22, 2022

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0f:f5:0e:15:d1:d2:93:3d:fe:2a:27:b8:df:b2:5e:5e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 13, 2020 - Apr 26, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

29760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsProcessorFeaturePresent GetCurrentThreadId ExitProcess FreeLibrary GetModuleHandleW GetModuleHandleExW GetProcAddress GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime LoadLibraryExW CompareStringW LCMapStringW MultiByteToWideChar GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead GetCurrentProcess SetUnhandledExceptionFilter TerminateProcess GetCurrentDirectoryW CreateFileW FindClose FindNextFileW CloseHandle GetStdHandle GetModuleFileNameW UnhandledExceptionFilter GetConsoleMode WaitForSingleObject InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive SetWaitableTimer CreateWaitableTimerW RtlUnwindEx EncodePointer RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader WriteFile GetFileType WriteConsoleW OutputDebugStringW FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadFile ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FlushFileBuffers SetEndOfFile IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCommandLineW GetCommandLineA SetLastError GetLastError GetComputerNameW LocalFree

crypt32

CryptProtectData

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetTimeouts WinHttpOpen WinHttpConnect

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vdd/parsec-vdd.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 e23332448fdaf5aa017cb308db5ef6855fac526a7ded05d80c039404126d5362
MD5 4b9a3048286692a865187013b70f44e8
SHA1 eefe91d9702314341acccd828fe4edb6ee570d7b
SHA512 a38b9a0a1626d9f40ff2c718717a793108c7e773b25493cc53c595e6b9840cc4de66587549f43ce00569b368834327184a90d55da3c4ae0e269e1d0edef6238d
SSDEEP 12288:QbLQNEFqf6MouZQqdF9zuAkDjdCjXHSZz2AKhAOYYA:QbUNEFKXrZ6ZjdFZxKhAOYv
TLSH
T1B8B423629E70C033CBF70F3152B9E55A0B7DDE2DE5159AD30314FD4A3D32A84992AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

75:e7:b0:48:ad:3b:a3:25:58:c4:65:75:1b:8d:ef:f2:6d:47:4c:79:a7:af:f0:5e:c0:67:e3:88:a2:2d:61:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 29, 2024

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH c1c7505e1e6e929ebb6b9100e55b050a
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
TLSH
T15EE10A3574C02CF7D0CD49743816791B83F4C52527BA05B04A7B1AD576E1AE7FE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

driver/mm.cat

SHA256 136e64ac07dce5a3b4935d5a9c5cfe03983c0b3065f46a30a45536d5b1681d5c
MD5 1fe1fc7cc73fb17e995d65835d51ca94
SHA1 249acf0a3a362b2163127bd76f6d4d6aa463297d
SHA512 31fe1bdcb5f243a6eecc40006fc70793bc5aea9d95ffe449117cb67366f0f120c393716ffe93b65a73c8b2dfe02917f1d0dcf4ca62aa302fe685513b8cc80bdc
SSDEEP 192:27bR3HCkJC9aJ9EwvZvhYC3kn5NQlO8X01k9z3AwkqY:aRJZvh3Un5KlO8R9zJkqY
TLSH
T1093219B1896841C2F9677C6093E8F9973C3D27C7582044A6269FFB190CA73C4FB2826D
MD5 SHA1 SHA512 SSDEEP TLSH

driver/mm.dll

IMPHASH 8ea2a4c54fa25433f775630a59c9d7ac
SHA256 96db6ae2f950b56e52be3e68f92893afa94645eae09fea2abd5dd1985758150a
MD5 f09967cc8cc9bf03612ddecb6bf86daa
SHA1 166f8e3000b6a1e2b13b46e85b7559b9837b9aa7
SHA512 190d2edea81c42a2d7a5bc69cb98f03368e702a5fcb3fc1dcd4e9c387687bab542e4b0e5de67292e8b8a7efed7fd9e30d1efdd35bcdfea28417de71db0e13864
SSDEEP 3072:3zx0G2cnU93aR9bN9m3KUrru7qqybewIvUZdRfCzzr/:3zS9w9m3KUHAVvUZWXz
TLSH
T1FB042964B7B420A1E9FB8670CBB209D3F6B971022F2056DF11A481690FA7BF4A53D35C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

2e:12:eb:5b:97:e4:cb:cb:ab:af:40:1e:9c:c7:20:30:53:04:6d:ce:72:33:dc:a2:7e:fb:fd:13:7b:f5:96:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 25, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 6, 2023 - Apr 3, 2024

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cd:55:07:2a:e7:ca:c1:99:1d:00:01:00:00:01:cd

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

68224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\gitsrc\parsec-cloud\magic-mirror\driver\x64\Release\mm.pdb

ntdll

RtlInitUnicodeString RtlUnwindEx DbgPrintEx RtlCompareMemory

advapi32

EventUnregister UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel TraceMessage EventWriteTransfer RegisterTraceGuidsW EventRegister GetTraceEnableFlags

wpprecorderum

WppAutoLogStart WppAutoLogStop WppAutoLogTrace

kernel32

CreateThread Sleep CreateEventW WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter GetLastError CloseHandle GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind DeleteCriticalSection WaitForMultipleObjects GetCurrentThreadId InitializeCriticalSectionEx ResetEvent WaitForSingleObjectEx WaitForMultipleObjectsEx DebugBreak OutputDebugStringA RtlLookupFunctionEntry GetSystemTimeAsFileTime RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue GetCurrentProcessId InitializeSListHead SetEvent FlsGetValue FlsAlloc SetLastError InterlockedFlushSList IsDebuggerPresent TerminateProcess

ole32

CoCreateGuid

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

api-ms-win-crt-heap-l1-1-0

calloc malloc free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s

api-ms-win-crt-string-l1-1-0

strcmp strncpy_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _seh_filter_dll _initterm_e _initterm _initialize_onexit_table _execute_onexit_table _cexit terminate abort

Name

.text

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PAGE

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

driver/mm.inf

SHA256 34da9ff45c13577631f67e33d11b8a26e3d22ca685d00c388b6122a795800588
MD5 d8030afe09a2f984be00389b31f7039b
SHA1 ab7a55fa6641cc31b0b7e70c8680bbbd553fc8a1
SHA512 0787e9e95369686b20bcbddb9ff984111c4ed53a064fc8f198691db5c124dfbe1b1f4d434dbfd81482545b723c01325ed9bcc626f461191b3ae4095222df10a6
SSDEEP 48:MoXx6bEEAkWfd6QxVO2X2iI+xCPOgbqGSW8nijzXk0m0hX:K4zDI+xCP1SW8niXX
TLSH
T14281A082A3DC0208B1F36E84EBF550B65A227C99593CE65D11E442DA5AF0E40DAF37E3
MD5 SHA1 SHA512 SSDEEP TLSH

mm.man

SHA256 e6a9944ca554b25d67b47b4d0dfbada6ea5ae7cb208b9ec09cfe6132bab4600f
MD5 481369808b1b657547bcd92a897c58c0
SHA1 847723989cf3c9c98b64549090e8260c922d9201
SHA512 42e6e7332dc0a6b14b308a4f04f1afdfcf950c6fcaa6609dd1730bd0a7aa6d764f56be05a45e94877b6d4028e0a312029baa7fa67f49d280f05a6ffe069d9e77
SSDEEP 96:tK5BbfK9K3H5KSHtMLutn1LuK9xFTxRo0JpAfKOuKtetnJnwgYDxRUmqU21+WJp:ARfK9K9pnJnw1qm/21+WJp
TLSH
T196D1BFD0F4B06C54851B3422AAB858056D3872E317DC91E27CCD8ED6FF5BF49A2AB391
MD5 SHA1 SHA512 SSDEEP TLSH

nefconw.exe

IMPHASH d08a75f41a2a78d420d594fc0d2927fb
SHA256 cf746d1b0bbb713993d4a90dccd774c78d9fff8c2ba5a054b6c8f56c77e1eee1
MD5 e9f2bc8c82ac755f47c7f89d1530f1a1
SHA1 7ce5938c4b8a3eb4de49f7a7e34972f5f2acfcb5
SHA512 86ed0a391d22631da9bdc7eb9cb096ba4de4c6619c6c4326030cb03d196b63e5aa156bac264a48d5b4cda7401844a3b5050259b41859d32e0c4d39b96913c2ce
SSDEEP 12288:o27GX/DYwTLMcdMcYsWpP86/6L94gsleElgEo0JFoG:o27GX/DYwTLMcdMcYtF8S6L94gslbOED
TLSH
T162C47B56A29403F9E9BB813888864502F771BC5607B49BEF03E046672F277E16F7E760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c2:4b:b9:d2:ca:f0:c5:9a:5b:68:20:95:7d:34:27:d0:58:73:c7:47:3f:14:db:76:52:53:ca:cc:3a:f4:90:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 26, 2024

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

222920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

UuidFromStringA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

setupapi

SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiOpenClassRegKey SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupFindFirstLineW SetupOpenInfFileW InstallHinfSectionW SetupDiGetActualSectionToInstallW SetupDiCallClassInstaller SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiDestroyDriverInfoList SetupDiSetDeviceRegistryPropertyW SetupCloseInfFile

kernel32

EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetLastError lstrlenW LocalAlloc GetLastError GetCurrentThread GetNativeSystemInfo LoadLibraryW GetProcAddress LocalFree FreeLibrary GetEnvironmentVariableA ReadFile GetSystemTimeAsFileTime GetModuleFileNameA GetCurrentProcess CloseHandle HeapAlloc GetProcessHeap FormatMessageA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetStdHandle MultiByteToWideChar MoveFileExA WideCharToMultiByte CompareStringW CreateDirectoryW ReadConsoleW GetFileAttributesExW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile GetFileAttributesA VirtualQuery FlsFree FlsSetValue FlsGetValue GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree RtlUnwind GetModuleHandleW LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile HeapFree GetFileType GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc

user32

MessageBoxW

advapi32

LookupPrivilegeValueW CreateServiceA AdjustTokenPrivileges SetFileSecurityW SetSecurityDescriptorOwner CloseServiceHandle AllocateAndInitializeSid OpenSCManagerA CopySid DeleteService OpenProcessToken FreeSid GetFileSecurityW CheckTokenMembership InitializeSecurityDescriptor GetLengthSid OpenServiceA GetTokenInformation RegCloseKey RegSetValueExW RegQueryValueExW

shell32

ord730 CommandLineToArgvW

Name

.text

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vddinstall.bat

SHA256 1e7c35eb6c296f96aee5ae4bbbd40395e8019bde95ef9bef91260dd8ef03c6d1
MD5 ee1bfb5ccbb3949e3258155e141a68a5
SHA1 b79dd1e75e3e7acd8d21d7b17c86673a6c6383d9
SHA512 b37d680f5dab52536926c718eb1b4c1f0e78552c061756f998e3a3ccb2dc4fbea15dd1a4b181646a68a2987a22ce225c185c2ef2bb1d10a70c780ada8cf9f9aa
TLSH
T12BE0AB2088B2ECF7583685393C275B01F417C1BA02E3DA80B8A16504BA4BFEF6B44107
MD5 SHA1 SHA512 TLSH

vdduninstall.bat

SHA256 8f503e40a32959d9d2ee5a9e2a3da627f6ed158e6c87c47ef17f1e5d74f47b9a
MD5 fbc8d5e19f89dffccd165f44abf114b4
SHA1 a07501ea396a4e29654352cf8ed71c7819109e5d
SHA512 08739f57b74ea457f505d416c5cc6c50539343ee33e80d76b95ca1a9b8760eaef9e97712a5824d8c22a7287c819149a6b60e6a08511e292cac71ef064ad168f6
TLSH
T197D02B104CB39CF76C6549243C639716F507C2AA02E39A54A4565500B60BFDF5B44107
MD5 SHA1 SHA512 TLSH

vusb/parsec-vud.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 f8db024b61c36e5d45ca5b485bf855dbfe1d0523333158e873d7deb4d86ec0e4
MD5 fa2814c8cff38b2f4737085c70154b8f
SHA1 e8e075c550dcbcf9b97aa7562d0ef26fa611f2a9
SHA512 199530058e78b6aad7a6fc77017c864edf9173d50ed7db1d0770486db06cdc8f59c682da3a896bbc87517e5a3d9727fe934aee972aa6ffdc2926d3021cf8c9c2
SSDEEP 24576:hfYjdl9QaRG2zB9aKXrZ6y8EZJIp8vbNCbW:t+uWGcjLPV5
TLSH
T1601523B5D6F0E730CD2B363320BEA91F65A1B3BD4045DACB875835E47A509818EAF760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

29:9b:ea:3a:35:7e:71:90:34:58:27:d0:38:74:69:e4:9c:1b:4d:33:a6:ae:4e:b1:fb:b8:28:36:4f:6e:79:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 23, 2024

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 a921cc9cc4af332be96186d60d2539cb413dfa44cfd73e85687f9338505ff85e
MD5 f8b6dd1f9620be4ef2ad1e81fb6b79fa
SHA1 f06c8c8650335bace41c8dbe73307cbe4e61b3b1
SHA512 f15811088ecde4cd0c038db2c278b7214e41728e382b25c65c2eb491bc0379c075841398e8c99e8cceba8be7e8342bc69d35836ebe9b12ebebff48d01d5fa61a
TLSH
T1A78173BB92E40CF3D0A44BB740A71CE362B5DD301762001F4A478AAA2590B67EE7E715
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nefconc.exe

IMPHASH dc815f97913fd406254f26cfd8b6c644
SHA256 002cbd46bbfaa2d9e04a578f7200711b5740bda119166f111e2590d8b19d3e68
MD5 dddee00430f7a3d52580b7c85d63d9dc
SHA1 ff3b7a60062ef85186ea305168cc9bc207a0c5b0
SHA512 faac2f9135aa58ddab6391d4711498a45f51a0429040833aea8d1f0f7c64ef27435c8a2d9c3e49c8bc8bdfec276ca455a719e2b401ea34994d57483c8fefe5ba
SSDEEP 12288:qmTp2f8iWOZiu7uRt3eWuHE0e14BdpfVuW70q2cJto9VuZHPq:nTp2f8iWOZiu7uRt3nIE0+4BdpfVuW7Q
TLSH
T1F1C47C5AA69402F8E4BB913C89424902F772B8660371CBEF03E046672F677E55F7E760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ea:63:23:7b:ae:89:d8:d4:3f:bc:c6:9e:3b:e6:26:8d:02:5f:5f:16:60:62:1d:ea:94:88:b4:91:42:d0:31:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 13, 2023

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

224992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

UuidFromStringA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

setupapi

SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupFindFirstLineW SetupOpenInfFileW InstallHinfSectionW SetupDiGetActualSectionToInstallW SetupDiCallClassInstaller SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiDestroyDriverInfoList SetupDiSetDeviceRegistryPropertyW SetupCloseInfFile SetupDiOpenClassRegKey

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetLastError lstrlenW LocalAlloc GetLastError GetCurrentThread GetNativeSystemInfo LoadLibraryW GetProcAddress LocalFree FreeLibrary GetEnvironmentVariableA EnumSystemLocalesW GetSystemTimeAsFileTime GetModuleFileNameA GetCurrentProcess CloseHandle HeapAlloc GetProcessHeap FormatMessageA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle MultiByteToWideChar MoveFileExA WideCharToMultiByte FlsFree ReadFile CreateDirectoryW ReadConsoleW GetFileAttributesExW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile GetFileAttributesA FlsSetValue FlsGetValue GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery RtlUnwind GetModuleHandleW LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW HeapFree GetFileType GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc

user32

MessageBoxW

advapi32

LookupPrivilegeValueW CreateServiceA AdjustTokenPrivileges SetFileSecurityW SetSecurityDescriptorOwner CloseServiceHandle AllocateAndInitializeSid OpenSCManagerA CopySid DeleteService OpenProcessToken FreeSid GetFileSecurityW CheckTokenMembership InitializeSecurityDescriptor GetLengthSid OpenServiceA GetTokenInformation RegCloseKey RegSetValueExW RegQueryValueExW

shell32

ord730

Name

.text

Size

406KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

nefconw.exe

IMPHASH d08a75f41a2a78d420d594fc0d2927fb
SHA256 cf746d1b0bbb713993d4a90dccd774c78d9fff8c2ba5a054b6c8f56c77e1eee1
MD5 e9f2bc8c82ac755f47c7f89d1530f1a1
SHA1 7ce5938c4b8a3eb4de49f7a7e34972f5f2acfcb5
SHA512 86ed0a391d22631da9bdc7eb9cb096ba4de4c6619c6c4326030cb03d196b63e5aa156bac264a48d5b4cda7401844a3b5050259b41859d32e0c4d39b96913c2ce
SSDEEP 12288:o27GX/DYwTLMcdMcYsWpP86/6L94gsleElgEo0JFoG:o27GX/DYwTLMcdMcYtF8S6L94gslbOED
TLSH
T162C47B56A29403F9E9BB813888864502F771BC5607B49BEF03E046672F277E16F7E760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c2:4b:b9:d2:ca:f0:c5:9a:5b:68:20:95:7d:34:27:d0:58:73:c7:47:3f:14:db:76:52:53:ca:cc:3a:f4:90:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 26, 2024

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=6033210,CN=Parsec Cloud\, Inc.,O=Parsec Cloud\, Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:68:12:e8:33:50:f1:ad:f4:e9:d5:67:f3:cf:82:5b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Jan 3, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

222920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

UuidFromStringA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

setupapi

SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiOpenClassRegKey SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupFindFirstLineW SetupOpenInfFileW InstallHinfSectionW SetupDiGetActualSectionToInstallW SetupDiCallClassInstaller SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiDestroyDriverInfoList SetupDiSetDeviceRegistryPropertyW SetupCloseInfFile

kernel32

EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetLastError lstrlenW LocalAlloc GetLastError GetCurrentThread GetNativeSystemInfo LoadLibraryW GetProcAddress LocalFree FreeLibrary GetEnvironmentVariableA ReadFile GetSystemTimeAsFileTime GetModuleFileNameA GetCurrentProcess CloseHandle HeapAlloc GetProcessHeap FormatMessageA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetStdHandle MultiByteToWideChar MoveFileExA WideCharToMultiByte CompareStringW CreateDirectoryW ReadConsoleW GetFileAttributesExW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile GetFileAttributesA VirtualQuery FlsFree FlsSetValue FlsGetValue GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree RtlUnwind GetModuleHandleW LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile HeapFree GetFileType GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc

user32

MessageBoxW

advapi32

LookupPrivilegeValueW CreateServiceA AdjustTokenPrivileges SetFileSecurityW SetSecurityDescriptorOwner CloseServiceHandle AllocateAndInitializeSid OpenSCManagerA CopySid DeleteService OpenProcessToken FreeSid GetFileSecurityW CheckTokenMembership InitializeSecurityDescriptor GetLengthSid OpenServiceA GetTokenInformation RegCloseKey RegSetValueExW RegQueryValueExW

shell32

ord730 CommandLineToArgvW

Name

.text

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

parsecvirtualds/parsecvirtualds.cat

SHA256 5b1e3b5cc9d372a603212df05317e3c21d675d25072adff5d9bffc83f9494aad
MD5 4d6c2c6d6fafb8b88220b4d729083e4b
SHA1 869c49be15edc1bea080b391a06751424b0438d0
SHA512 552b847c79b5edbfa9bc9ec69f24a9c2bb9fa1ba34098d7ca225813cd3d10f27e4793d416df0e81e0b2e04d3dc7eaa3c03c506489a0e75de61bb2d32cfb10d0b
SSDEEP 192:BqyERJCDnEwKUNhYCusAnz8RwX01k9z3AQTEtL0L:2zUNh3usCz9R9z/Qw
TLSH
T1403229E5856C00C3FDE7AC2043E4E9877C7A33CB481054A666AAF7591DA73C5FB2812D
MD5 SHA1 SHA512 SSDEEP TLSH

parsecvirtualds/parsecvirtualds.inf

SHA256 6a1f40f2676f15136127300e016cc4bea6d81c7172b803fcca0a5c2b88ac0b65
MD5 d96009c654e481183642833359589653
SHA1 21e91a516de0195c6887a74d2f6b1d29c7e1bb17
SHA512 031e4be50230aafb4c2828e2f04224681849eb5b6a3cf97d8f07b3dcd5a6e7781ab1a72ceda12384b13f041bb5ddc304a786a35860a903918d3d38a085bb631a
TLSH
T1AA21774C51A34DBA209A31AB1F030B43F518218029E8A41E77F9B05EBFD0D6CC73B0A7
MD5 SHA1 SHA512 TLSH

parsecvirtualds/parsecvirtualds.sys

IMPHASH f01e1990a206fe785af77a679de65148
SHA256 8638b464e103eeba9e89fba91b38d366d4674c4d92629bb76aae1dfd40927fe0
MD5 9abec9361fe91486b88842c94de1de34
SHA1 dc855763130fdadd3024212aa3a47010a48abb8d
SHA512 304b7d80002aad1d5ac3e3247ba9fade291d06859174e6b6e5aa09b15ad4ac9ebbb9418277b7f84949378fcbe3723718177d60daf5b2aca1895392cefd324d75
SSDEEP 384:DOq45ajAwai+E3n5bWbbc5nqRTjdfHpl9fUNh33aEpcR9zuqr:D/45al/Rc8w1Hf9sH33aEpw9zlr
TLSH
T11AC26DD563A420D2E9EB8871D2E0D6437DF9B6531B2296DF04D8E4252F777C0EA3831A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

5f:c3:eb:f5:0a:77:05:e7:2b:b9:20:4b:a5:1a:8d:87:ab:fc:72:cb:c8:37:bc:24:25:da:cb:9a:eb:93:8c:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 23, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:69:9d:42:c9:76:75:b5:08:82:00:00:00:00:00:69

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 11, 2024 - Jan 10, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

6768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\UnitySrc\parsec-cloud\usb-ip\parsecvirtualds\src\x64\Release\parsecvirtualds.pdb

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

parsecvusba/parsecvusba.cat

SHA256 7b524bc6d08c0d823dd23483232b1fc68450158ab9f16c7aece2db2532fa13a5
MD5 4113939133980818d62982aae840fa03
SHA1 ab8a3ac7cdabf561d9eab727a5817e3c1e2b1825
SHA512 94e004771a9f5dd82e5c14ae2a7381eeb6ff7e9a59358bda8ab326ea24fcef157c10fa9dc177838d6f25a762960ea509b1e688ef5b2336958e63268fc997e915
SSDEEP 192:z5Q3GvE/JCEnEwKUNhYC5WhVXC4dlgX01k9z3AUjbDaLVR4Ze:zG2SIUNh3+VXC4deR9zVjb2L74g
TLSH
T14E4218E2546C5083FDABAC6043E8F9A77C3A37CB5C4010A6559BE6561CA73C9FB3412D
MD5 SHA1 SHA512 SSDEEP TLSH

parsecvusba/parsecvusba.inf

SHA256 95e9899b2acf64052ea5c09cbde901f9bbd6b13b5c843ae999ac6d3429344de8
MD5 c4e261319a038b316e74eeb21159eb0c
SHA1 ffff79fa80a06cf80ca8b5a2b8140f1fa25180a4
SHA512 832dee4e25417f619a47a3a5458011e90f3d188406b748a318bf22c6a90cd0ed950f561c90a5b6191c21c5cec8c631b6c1f4be1e2d099f9abe024029a3577455
TLSH
T13D5159694A860F36F067966B7ECA6FE0B328395510D8401D36DE794C3FAC88D2B0F4E1
MD5 SHA1 SHA512 TLSH

parsecvusba/parsecvusba.sys

IMPHASH e2cc2054a2b781f4227b00932264300a
SHA256 dc24fa47b151fe4fb604b47ec495f2b8911380064d964ad6adbd148d98631e74
MD5 566dcaa6c8bc45eb82c0a8c9f60ac7e9
SHA1 f6ff379bf3b9a50a20741fecc93de079b4c173c4
SHA512 209e5f94c6c24f3a453dd8b2125ce4b6e1b658ac5b58b1d5275c0ca71f74b7e2edd27ffaee57a2ccee46cc46dbc2b9047a75df4355c60fb14fdec1533c01a823
SSDEEP 6144:192SEoRb3Jdb6J6tLh7iY7hZ9nlfk3S8r:192SEoRb3JdO4tLFiYn9nlfk3S8r
TLSH
T1774418A4B27915A0D8F786788AA30423E7FA71053F314ADF119641662B67BF8F13D31E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

4c:9a:4a:59:bf:3e:34:a0:36:cd:8c:99:ff:68:4d:b6:0b:51:18:1b:bb:f5:b6:c5:d4:a2:08:b7:29:6b:23:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 23, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:69:9d:42:c9:76:75:b5:08:82:00:00:00:00:00:69

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 11, 2024 - Jan 10, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e9:0f:71:30:7e:5d:f1:12:36:00:01:00:00:01:e9

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

128272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\UnitySrc\parsec-cloud\usb-ip\pcvudhc\x64\Release\parsecvusba.pdb

ntoskrnl.exe

KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock strcmp RtlAssert RtlCompareUnicodeStrings SeTokenIsAdmin ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenEvent ExEventObjectType strncpy_s _vsnprintf ExAllocatePoolWithTag RtlRandomEx sprintf_s ZwOpenKey ZwQueryValueKey KeCapturePersistentThreadState ZwWriteFile NtBuildNumber DbgPrintEx RtlCaptureContext KeDeregisterBugCheckReasonCallback KeRegisterBugCheckReasonCallback KeResetEvent IoWMIRegistrationControl MmGetSystemRoutineAddress RtlAnsiCharToUnicodeChar KeDelayExecutionThread KeSetEvent KeWaitForSingleObject KeInitializeEvent RtlCompareUnicodeString KeClearEvent RtlCopyUnicodeString RtlInitUnicodeString IoGetDeviceInterfaces ExFreePoolWithTag RtlCompareMemory

ext-ms-win-ntos-werkernel-l1-1-1

WerLiveKernelOpenDumpFile WerLiveKernelCancelReport WerLiveKernelCreateReport WerLiveKernelSubmitReport WerLiveKernelCloseHandle

hal

KeQueryPerformanceCounter

wpprecorder.sys

imp_WppRecorderLogGetDefault imp_WppRecorderLogDelete imp_WppRecorderLogCreate imp_WppRecorderReplay WppAutoLogStop WppAutoLogStart WppAutoLogTrace imp_WppRecorderIsDefaultLogAvailable

wdfldr.sys

WdfVersionBind WdfLdrQueryInterface WdfVersionUnbind WdfVersionUnbindClass WdfVersionBindClass

Name

.text

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGED

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PAGE

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vusbinstall.bat

SHA256 94ee200ca574dd4499779048db279264c872833c96a500e0f49b1342ee5f4802
MD5 3b3ca1091eb59f0fa9ed9c9a50b3bf81
SHA1 bd3a9cccd279e4fff79ae840d6397b1e8ab8cba0
SHA512 8f86db66c0bfc7e043eed738cf026acf6aead862410a17fe02a2e26fdeb77b59a1162b1d67868a428f9b0c604a31963cba8ef534b25af1bc60448424ca6ccd1b
TLSH
T190E0861008329CEFA9A58E373A6B2317700ED9D844F1714C79F17808BA1F03F0626D01
MD5 SHA1 SHA512 TLSH

vusbuninstall.bat

SHA256 e5a72f8064de9b266ced03c042daef6ba9682cf0ba66bf8236e30e6169e88f0e
MD5 8e8f18f9109fcc7b93b2770be222fa53
SHA1 e49d59e3161e33de73d96ad95b41a1ea979c5c06
SHA512 26402ec20431ac71469b6f886c00183a30f2e8f5009004b9bad54c5a6afdea88aaa56e567ce048a35a76655f9aaa8d86cf69a35aa951786f8a0da933b7f311c5
TLSH
T1C8E0861108325CEBAC988E27395B2317B40E999804F1720969F17804B91F06F1622902
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer