88977075356dc9e4c81ff59e5ffc004ab3d62070c1062ce7b690a941d5328090

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PCWUpdater.exe
Size

423KB
MD5

f3b1b338ce6cbb2b2b2de1b5e6b7c49d
SHA1

6d9c9564a0c5784017f32bc2881d955c73c6155b
SHA256

481fe01d12228ecd30410f09e0390f1876ff3baec7ebde5ccb1d2165a01582b8
SHA512

f524fa1804cbcb31e008cc0ae6d1854ed21e40cd2f192dd300354a01203d112ef7711de30973a06e0b691e9b3236f1aab17ec247d63bff79a43df817c4489313
SSDEEP

12288:50QOmCU/iH9CImgdH1C89qH0y9pGHNu4B2UipYB:T389CIm7826I4reYB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2172	PCWProtectorService.exe
2572	PCWProtector.exe

Loads dropped DLL 9 IoCs

pid	Process
3060	PCWProtectorDummy.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1504	PCWUpdater.exe
1504	PCWUpdater.exe
1504	PCWUpdater.exe
1504	PCWUpdater.exe
1504	PCWUpdater.exe
1504	PCWUpdater.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
3060	PCWProtectorDummy.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2172	PCWProtectorService.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2172	PCWProtectorService.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2172	PCWProtectorService.exe
2172	PCWProtectorService.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	PCWUpdater.exe
Token: SeDebugPrivilege	1504	PCWUpdater.exe
Token: SeDebugPrivilege	2172	PCWProtectorService.exe
Token: SeDebugPrivilege	3060	PCWProtectorDummy.exe
Token: SeDebugPrivilege	2572	PCWProtector.exe
Token: SeDebugPrivilege	2548	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2280	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2676	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2684	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2776	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2512	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2560	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1536	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2664	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2436	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2456	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2496	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2960	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2956	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1800	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1580	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1488	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2788	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2836	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2808	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2916	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2968	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2932	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1032	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1308	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1016	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1696	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1056	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1784	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1344	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1328	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2168	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2740	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2760	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2716	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1068	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1984	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2076	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2072	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2092	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2876	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2300	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2120	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2888	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2104	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2408	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	704	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	780	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	836	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1476	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1468	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2132	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1624	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1808	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1088	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1528	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	688	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	1084	PCWProtectorDummy64.exe
Token: SeDebugPrivilege	2392	PCWProtectorDummy64.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1504	PCWUpdater.exe
1504	PCWUpdater.exe
3060	PCWProtectorDummy.exe
3060	PCWProtectorDummy.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2572	PCWProtector.exe
2548	PCWProtectorDummy64.exe
2548	PCWProtectorDummy64.exe
2280	PCWProtectorDummy64.exe
2280	PCWProtectorDummy64.exe
2676	PCWProtectorDummy64.exe
2676	PCWProtectorDummy64.exe
2684	PCWProtectorDummy64.exe
2684	PCWProtectorDummy64.exe
2776	PCWProtectorDummy64.exe
2776	PCWProtectorDummy64.exe
2512	PCWProtectorDummy64.exe
2512	PCWProtectorDummy64.exe
2560	PCWProtectorDummy64.exe
2560	PCWProtectorDummy64.exe
1536	PCWProtectorDummy64.exe
1536	PCWProtectorDummy64.exe
2664	PCWProtectorDummy64.exe
2664	PCWProtectorDummy64.exe
2436	PCWProtectorDummy64.exe
2436	PCWProtectorDummy64.exe
2456	PCWProtectorDummy64.exe
2456	PCWProtectorDummy64.exe
2496	PCWProtectorDummy64.exe
2496	PCWProtectorDummy64.exe
2960	PCWProtectorDummy64.exe
2960	PCWProtectorDummy64.exe
2956	PCWProtectorDummy64.exe
2956	PCWProtectorDummy64.exe
1800	PCWProtectorDummy64.exe
1800	PCWProtectorDummy64.exe
1580	PCWProtectorDummy64.exe
1580	PCWProtectorDummy64.exe
1488	PCWProtectorDummy64.exe
1488	PCWProtectorDummy64.exe
2788	PCWProtectorDummy64.exe
2788	PCWProtectorDummy64.exe
2836	PCWProtectorDummy64.exe
2836	PCWProtectorDummy64.exe
2808	PCWProtectorDummy64.exe
2808	PCWProtectorDummy64.exe
2916	PCWProtectorDummy64.exe
2916	PCWProtectorDummy64.exe
2968	PCWProtectorDummy64.exe
2968	PCWProtectorDummy64.exe
2932	PCWProtectorDummy64.exe
2932	PCWProtectorDummy64.exe
1032	PCWProtectorDummy64.exe
1032	PCWProtectorDummy64.exe
1308	PCWProtectorDummy64.exe
1308	PCWProtectorDummy64.exe
1016	PCWProtectorDummy64.exe
1016	PCWProtectorDummy64.exe
1696	PCWProtectorDummy64.exe
1696	PCWProtectorDummy64.exe
1056	PCWProtectorDummy64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3060	2172	PCWProtectorService.exe	29
PID 2172 wrote to memory of 3060	2172	PCWProtectorService.exe	29
PID 2172 wrote to memory of 3060	2172	PCWProtectorService.exe	29
PID 2172 wrote to memory of 3060	2172	PCWProtectorService.exe	29
PID 3060 wrote to memory of 2572	3060	PCWProtectorDummy.exe	30
PID 3060 wrote to memory of 2572	3060	PCWProtectorDummy.exe	30
PID 3060 wrote to memory of 2572	3060	PCWProtectorDummy.exe	30
PID 3060 wrote to memory of 2572	3060	PCWProtectorDummy.exe	30
PID 2572 wrote to memory of 2548	2572	PCWProtector.exe	31
PID 2572 wrote to memory of 2548	2572	PCWProtector.exe	31
PID 2572 wrote to memory of 2548	2572	PCWProtector.exe	31
PID 2572 wrote to memory of 2548	2572	PCWProtector.exe	31
PID 2572 wrote to memory of 2280	2572	PCWProtector.exe	32
PID 2572 wrote to memory of 2280	2572	PCWProtector.exe	32
PID 2572 wrote to memory of 2280	2572	PCWProtector.exe	32
PID 2572 wrote to memory of 2280	2572	PCWProtector.exe	32
PID 2572 wrote to memory of 2676	2572	PCWProtector.exe	33
PID 2572 wrote to memory of 2676	2572	PCWProtector.exe	33
PID 2572 wrote to memory of 2676	2572	PCWProtector.exe	33
PID 2572 wrote to memory of 2676	2572	PCWProtector.exe	33
PID 2572 wrote to memory of 2684	2572	PCWProtector.exe	34
PID 2572 wrote to memory of 2684	2572	PCWProtector.exe	34
PID 2572 wrote to memory of 2684	2572	PCWProtector.exe	34
PID 2572 wrote to memory of 2684	2572	PCWProtector.exe	34
PID 2572 wrote to memory of 2776	2572	PCWProtector.exe	35
PID 2572 wrote to memory of 2776	2572	PCWProtector.exe	35
PID 2572 wrote to memory of 2776	2572	PCWProtector.exe	35
PID 2572 wrote to memory of 2776	2572	PCWProtector.exe	35
PID 2572 wrote to memory of 2512	2572	PCWProtector.exe	36
PID 2572 wrote to memory of 2512	2572	PCWProtector.exe	36
PID 2572 wrote to memory of 2512	2572	PCWProtector.exe	36
PID 2572 wrote to memory of 2512	2572	PCWProtector.exe	36
PID 2572 wrote to memory of 2560	2572	PCWProtector.exe	37
PID 2572 wrote to memory of 2560	2572	PCWProtector.exe	37
PID 2572 wrote to memory of 2560	2572	PCWProtector.exe	37
PID 2572 wrote to memory of 2560	2572	PCWProtector.exe	37
PID 2572 wrote to memory of 1536	2572	PCWProtector.exe	38
PID 2572 wrote to memory of 1536	2572	PCWProtector.exe	38
PID 2572 wrote to memory of 1536	2572	PCWProtector.exe	38
PID 2572 wrote to memory of 1536	2572	PCWProtector.exe	38
PID 2572 wrote to memory of 2664	2572	PCWProtector.exe	39
PID 2572 wrote to memory of 2664	2572	PCWProtector.exe	39
PID 2572 wrote to memory of 2664	2572	PCWProtector.exe	39
PID 2572 wrote to memory of 2664	2572	PCWProtector.exe	39
PID 2572 wrote to memory of 2436	2572	PCWProtector.exe	40
PID 2572 wrote to memory of 2436	2572	PCWProtector.exe	40
PID 2572 wrote to memory of 2436	2572	PCWProtector.exe	40
PID 2572 wrote to memory of 2436	2572	PCWProtector.exe	40
PID 2572 wrote to memory of 2456	2572	PCWProtector.exe	41
PID 2572 wrote to memory of 2456	2572	PCWProtector.exe	41
PID 2572 wrote to memory of 2456	2572	PCWProtector.exe	41
PID 2572 wrote to memory of 2456	2572	PCWProtector.exe	41
PID 2572 wrote to memory of 2496	2572	PCWProtector.exe	42
PID 2572 wrote to memory of 2496	2572	PCWProtector.exe	42
PID 2572 wrote to memory of 2496	2572	PCWProtector.exe	42
PID 2572 wrote to memory of 2496	2572	PCWProtector.exe	42
PID 2572 wrote to memory of 2960	2572	PCWProtector.exe	43
PID 2572 wrote to memory of 2960	2572	PCWProtector.exe	43
PID 2572 wrote to memory of 2960	2572	PCWProtector.exe	43
PID 2572 wrote to memory of 2960	2572	PCWProtector.exe	43
PID 2572 wrote to memory of 2956	2572	PCWProtector.exe	44
PID 2572 wrote to memory of 2956	2572	PCWProtector.exe	44
PID 2572 wrote to memory of 2956	2572	PCWProtector.exe	44
PID 2572 wrote to memory of 2956	2572	PCWProtector.exe	44

C:\Users\Admin\AppData\Local\Temp\PCWUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\PCWUpdater.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1504

C:\Users\Admin\AppData\Local\Temp\PCWProtectorService.exe
C:\Users\Admin\AppData\Local\Temp\PCWProtectorService.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy.exe
  C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy.exe 1
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Users\Admin\AppData\Local\Temp\PCWProtector.exe
    C:\Users\Admin\AppData\Local\Temp\PCWProtector.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:704
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:780
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:836
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:688
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:560
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:608
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\PCWProtectorDummy64.exe
      PCWProtectorDummy64.exe 0
      4⤵
      PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PCWProtector.log

Filesize
1021B

MD5
13b89a16e95cb39b3231a5c9bff2c48b

SHA1
1b432413e1938b9a63ecce2ddb74275e2f61a303

SHA256
7f1967f53611f0801a6d430c5a6f4a6e4b3f14647eb099273a6927d2158723ff

SHA512
e99cb4b414a97ff63c67da285eaaa461de1421278a42b6b858611d1e5ef599fbdd88d7b9312ac58f17a662007889f8533fcf44a6f939f88120039fbc08f1f8d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCWProtector.log

Filesize
193B

MD5
f50d074474b9d69c505c1fdd4f660ea3

SHA1
ce418186b601baab07397b37fc1083cafe91d042

SHA256
719a69dc98e089e4d0dbc541b526d4195779ffffe42f8c6de549a28be0c96791

SHA512
28f21cf68d7ee649295139e59938e1de9c2093bb90753b6a432388d12f171bc47a9c0a90c18539efe029dc9863bf5f7bc2e847bed73a3a6d6dc8638b5656e014

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCWProtector.log

Filesize
764B

MD5
d6184eeab28e66bc8caaef63af3a4f58

SHA1
d043b7647035f66d495ff889a1534e7cb1515d1a

SHA256
1599ff013f16bacb47f87a492552a832f4cdb8f5613f65bbdc290b12a1384498

SHA512
8769271f914b01fcec8fdf0816a2389d2fea133be7f71386509fba10ff9120cff4fd3506de0e42c8e7d1ef742ac006a7286efaa3009b46da1da525b2b01e4f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCWProtectorService.exe

Filesize
242KB

MD5
f637513089742ab2d236a35941bf7140

SHA1
736335cb4963ffb93f282fd3ac6c8cba9acf8bd5

SHA256
31658ce6d0128abcebf3b135991a8e742b57de66f4d557d10106c0341b1413e7

SHA512
117cfa2fa1b6fb192be5679bfee1a8f55afbd920a8af50b636379c4a519f626745645d8ff94a2446a007b1c7dfd66070a3e22f9218b3f25dcb2fb8863b4c7d4a

Download Submit
\Users\Admin\AppData\Local\Temp\PCWProtector.exe

Filesize
567KB

MD5
6ce74b64aee3c89d3939bb15ecfe7888

SHA1
58ec5c6b43b90aaa6fa7919c1dbf46812378efae

SHA256
ccb0bd5f3e296c35b38348cf4f231f93ce9bb57af42c328b0aba9e29103ee391

SHA512
f39486655c3d58a62d5c310ce181da0f7dee61e2d3179571b6c1e25ceba3b20c9061565708b8e7c5c5232ca3210348ed82305a105b3b678fadef7b62a2be8c64

Download Submit