| File name: | tcmd1151x64.exe |
| Full analysis: | https://app.any.run/tasks/273628e1-8e69-4ef7-bd7c-efcbf18bb2a3 |
| Verdict: | Malicious activity |
| Analysis date: | June 21, 2025, 19:14:20 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, InstallShield self-extracting archive, 5 sections |
| MD5: | 6E7912656232B9E17DE4F7B5E2F8F506 |
| SHA1: | 0B9104B001DD9B7763C8A53A122035C0BBA8A077 |
| SHA256: | D5D78DA73B44C176540A8F9A89E7A3852CADB22EB7AF1D8F66C552D6E2A25371 |
| SSDEEP: | 98304:shsdR5f5p99039qPcujlfsrKPJTRKGBdzgcr2yd5wFqwtxV9iRj4B3ReehIv5HEV:+x/m9vMlGvppJ7qOzWkO |
MALICIOUS
No malicious indicators.SUSPICIOUS
There is functionality for taking screenshot (YARA)
- tcmd1151x64.exe (PID: 6612)
- TOTALCMD64.EXE (PID: 1932)
Executable content was dropped or overwritten
- tcmd1151x64.exe (PID: 6612)
Drops 7-zip archiver for unpacking
- tcmd1151x64.exe (PID: 6612)
Drops a system driver (possible attempt to evade defenses)
- tcmd1151x64.exe (PID: 6612)
Creates a software uninstall entry
- tcmd1151x64.exe (PID: 6612)
INFO
Reads the computer name
- tcmd1151x64.exe (PID: 6612)
- TOTALCMD64.EXE (PID: 1932)
The sample compiled with english language support
- tcmd1151x64.exe (PID: 6612)
Creates files or folders in the user directory
- tcmd1151x64.exe (PID: 6612)
- TOTALCMD64.EXE (PID: 1932)
Checks supported languages
- tcmd1151x64.exe (PID: 6612)
- TOTALCMD64.EXE (PID: 1932)
Creates files in the program directory
- tcmd1151x64.exe (PID: 6612)
Manual execution by a user
- TOTALCMD64.EXE (PID: 1932)
Process checks whether UAC notifications are on
- TOTALCMD64.EXE (PID: 1932)
Compiled with Borland Delphi (YARA)
- TOTALCMD64.EXE (PID: 1932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:01:16 10:19:01+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 8 |
| CodeSize: | 148480 |
| InitializedDataSize: | 66048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x18220 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.51.0.0 |
| ProductVersionNumber: | 11.51.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | Ghisler Software GmbH |
| FileDescription: | Total Commander Installer |
| FileVersion: | 11.51 |
| InternalName: | INSTALL |
| LegalCopyright: | Copyright © Ghisler Software GmbH 1993-2025 |
| OriginalFileName: | install.exe |
| ProductName: | Total Commander Installer |
| ProductVersion: | 11.51 |
Total processes
141
Monitored processes
4
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1932 | "C:\Program Files\totalcmd\TOTALCMD64.EXE" | C:\Program Files\totalcmd\TOTALCMD64.EXE | — | explorer.exe | |||||||||||
User: admin Company: Ghisler Software GmbH Integrity Level: MEDIUM Description: Total Commander Version: 11.51.0.0 Modules
| |||||||||||||||
| 3948 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6612 | "C:\Users\admin\AppData\Local\Temp\tcmd1151x64.exe" | C:\Users\admin\AppData\Local\Temp\tcmd1151x64.exe | explorer.exe | ||||||||||||
User: admin Company: Ghisler Software GmbH Integrity Level: HIGH Description: Total Commander Installer Exit code: 0 Version: 11.51 Modules
| |||||||||||||||
| 6852 | "C:\Users\admin\AppData\Local\Temp\tcmd1151x64.exe" | C:\Users\admin\AppData\Local\Temp\tcmd1151x64.exe | — | explorer.exe | |||||||||||
User: admin Company: Ghisler Software GmbH Integrity Level: MEDIUM Description: Total Commander Installer Exit code: 3221226540 Version: 11.51 Modules
| |||||||||||||||
Total events
1 334
Read events
1 314
Write events
20
Delete events
0
Modification events
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander |
| Operation: | write | Name: | IniFileName |
Value: %APPDATA%\GHISLER\wincmd.ini | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander |
| Operation: | write | Name: | FtpIniName |
Value: %APPDATA%\GHISLER\wcx_ftp.ini | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander |
| Operation: | write | Name: | InstallDir |
Value: C:\Program Files\totalcmd | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander |
| Operation: | write | Name: | IniFileName |
Value: %APPDATA%\GHISLER\wincmd.ini | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander |
| Operation: | write | Name: | FtpIniName |
Value: %APPDATA%\GHISLER\wcx_ftp.ini | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander |
| Operation: | write | Name: | InstallDir |
Value: C:\Program Files\totalcmd | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ghisler\Total Commander |
| Operation: | write | Name: | IniFileName |
Value: %APPDATA%\GHISLER\wincmd.ini | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ghisler\Total Commander |
| Operation: | write | Name: | FtpIniName |
Value: %APPDATA%\GHISLER\wcx_ftp.ini | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ghisler\Total Commander |
| Operation: | write | Name: | InstallDir |
Value: C:\Program Files\totalcmd | |||
| (PID) Process: | (6612) tcmd1151x64.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Totalcmd64 |
| Operation: | write | Name: | DisplayName |
Value: Total Commander 64-bit (Remove or Repair) | |||
Executable files
24
Suspicious files
8
Text files
68
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_DUT.LNG | text | |
MD5:B6E35A160E8806B832E903A108E7DBAF | SHA256:C7159D279E97DABF47993254B5AD106AAB896D095B1BCAF2EB207C266FAACA99 | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_ESP.LNG | text | |
MD5:36DBAB21C2A512F7D57EFAC31C13A893 | SHA256:F793E8FEBD86CC738D685359F37A9FCF88B949454A8571B13FED8A6F50616C98 | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_CZ.INC | text | |
MD5:EA550941F843D1023B0E6F5521C9F753 | SHA256:730F98D3B8ED2578E43B9A9C855A8CA243F433B4C3F413F9245DBAC3368F0065 | |||
| 6612 | tcmd1151x64.exe | C:\Users\admin\AppData\Roaming\GHISLER\wincmd.ini | text | |
MD5:8D158FF6C3D1872A17896CA8A116C9B1 | SHA256:6F54122F094088382BACECFEE05210769EA957F5CDD35B6F4E1E69EA6851EBE8 | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_CZ.MNU | text | |
MD5:274B975F020BCA432F36F940DBE1F079 | SHA256:3F2DCEB5678A39E6A301AABA1FAF02D5D2C06FDC6AEFF4C7ABF2E4A89936E6BE | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_DAN.LNG | text | |
MD5:7F92BD8D248E18D1126A0361FB482905 | SHA256:5C0677EE3E149909B77CB367368970B677306AF204BAA5F2B252C4DF1572283F | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_DEU.LNG | text | |
MD5:FE76B84E1CED7571308F65B4A58FBB0B | SHA256:97F3E37BCB855716B1DE87546EC49F76F9EACDAA3427F25D0F4F4133A9CFE519 | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_DAN.INC | text | |
MD5:E0A048768B62533610E1FD8936C22C0A | SHA256:1D104EC9C087A9A63A8B7708E317F01BA7349A9D6806B50131EAF5001E5CDCB4 | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_DAN.MNU | text | |
MD5:53D7C6BD7EA5A438B014916E3A29A121 | SHA256:DF48EBB26915756DDE7F4BB74A0AE1291053E3E4F6B914FD5F2F624F285D3B64 | |||
| 6612 | tcmd1151x64.exe | C:\Program Files\totalcmd\LANGUAGE\WCMD_DEU.MNU | text | |
MD5:BBA71DF7344537B832F84FD845697CD3 | SHA256:44CB36B58BADDD7C53DDFB2DFCC8CA1FA47054F7CD5083E710B4D74B07FEF9F0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
724 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
724 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1652 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6012 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
724 | SIHClient.exe | 172.202.163.200:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | whitelisted |
724 | SIHClient.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |