What network ports or protocols might pcalua.exe use?

It utilizes pcalua.exe (PCA) to execute an executable file, potentially launching the next malware stage called RedCurl.Downloader. RedCurl.Downloader, upon. InitiatingProcessFileName contains "Pcalua.exe" or. InitiatingProcessFileName ... | where InitiatingProcessCommandLine != @"rundll32.exe C:\WINDOWS\system32\ ... Jan 13, 2025 ... Researchers identified RedCurl APT group activity in Canada in late 2024, where the attackers used scheduled tasks to execute pcalua.exe to run malicious ... Jul 4, 2023 ... The process pcalua.exe is related to Program Compatibility Assistant, which is responsible for detecting known compatibility issues in older ... Nov 18, 2020 ... In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. • application=%System%\pcalua.exe -a %Application Data%\pcname1.exe. To ... Oct 25, 2021 ... I gonna link my other post to short this out. Problems with the svchost.exe and iassdo.dll.mui Here I having multiple issues, ... Nov 18, 2024 ... pcalua command line switches are not officially documented but here they are: -a - path the executable to be started. Or a dll to be loaded. Execute commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This is used as a LOLBIN for example to bypass application ... Attack Commands: Run with command_prompt ! pcalua.exe -a #{process} pcalua.exe -a #{payload_path}. Atomic Test #2 - Indirect Command Execution - forfiles.exe. Aug 8, 2024 ... Description: Analysis of host data on %{Compromised Host} detected the use of pcalua.exe to launch executable code. Pcalua.exe is component of ...