Procedure examples

PcShare can collect files and information from a compromised host.

PcShare can search the registry files of a compromised host.

PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.

PcShare has been encrypted with XOR using different 32-long Base16 strings.

PcShare has been compressed with LZW algorithm.

PcShare has used an invalid certificate in attempt to appear legitimate.

PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.

PcShare can upload files and information from a compromised host to its C2 servers.

The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.

PcShare has the ability to capture keystrokes.

PcShare can obtain a list of running processes on a compromised host.

PcShare can execute `cmd` commands on a compromised host.

PcShare has deleted its files and components from a compromised host.

PcShare has used HTTP for C2 communication.

PcShare has used a variety of Windows API functions.

PcShare can delete its persistence mechanisms from the registry.

PcShare can take screen shots of a compromised machine.

PcShare can capture camera video as part of its collection process.

PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.

PcShare has used `rundll32.exe` for execution.

PcShare has created the `HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32` Registry key for persistence.