Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1418s
  • max time network
    1225s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 05:44

General

  • Target

    https://dl.malwarewatch.org/software/useful/TotalCommander.zip

Malware Config

Extracted

Path

\??\c:\totalcmd\HISTORY.TXT

Ransom Note
31.03.19 Re-elease Total Commander 9.22a final (32/64) 31.03.19 Fixed: Couldn't unpack ZIP files with LZMA compression (64) 29.03.19 Release Total Commander 9.22a final (32/64) 29.03.19 Fixed: Difficult to reproduce crash in F7 new folder inside ZIP archives (timing problem with removing progress dialog) (32/64) 27.03.19 Fixed: F7 new folder: Invalid name created when user specifies path in zip incorrectly with starting and/or trailing slash, e.g. /dir1/dir2/dir3/ (32/64) 27.03.19 Fixed: F7 new folder: ensure that the dialog isn't displayed outside of the current screen (32/64) 26.03.19 Fixed: Alt+F5 pack: Invalid name created when user specifies path in zip incorrectly with trailing forward slash, e.g. c:\test\test.zip/dir1/dir2/ (32/64) 26.03.19 Fixed: Viewing LZMA-compressed files in ZIP sometimes failed with an unpack error (64) 25.03.19 Fixed: Ctrl+Q, click on active tab header of current tab above the quick view panel -> Tab no longer switched sides (32/64) 25.03.19 Fixed: Duplicating a tab which was locked with directory changes allowed could leave it with an empty name if it caused an additional line of tabs to appear (32/64) 21.03.19 Fixed: Couldn't open 7z archives with Unicode characters from different codepage (e.g. Chinese on English Windows) (64) 21.03.19 Fixed: Leaving branch view inside archive with Ctrl+B no longer went to the directory of the file under the cursor (32/64) 19.03.19 Fixed: Internal associations: **ext only worked for packer plugins, not for internal unpackers like **zip. Now also supports **internal_zip to override external packers (32/64) 19.03.19 Fixed: Opening xlsx files associated with Office 365 app (Windows 10) failed, they opened as ZIP files instead (32/64) 19.03.19 Fixed: In the following dialogs, ENTER confirmed the dialog also on other buttons like Cancel: password input, pack/unpack, other general input dialogs (64) 17.03.19 Fixed: Packing/unpacking with ace32.exe 2.6 didn't work - it expects ";" as delimiter in list file instead of line break (32/64) 17.03.19 Fixed: Do not try to unpack archives with ":" in them after the second character in them with F5 using external unpackers (32/64) 17.03.19 Fixed: Do not try to unpack ace archives with absolute paths or ..\ in them with external ace32.exe or winace.exe via Alt+F9 (32/64) 17.03.19 Fixed: Width of drive dropdown combobox (Alt+F1/Alt+F2) wrong when using screens with different DPI (32/64) 17.03.19 Fixed: Icons in file lists displayed incorrectly when moving main window to a screen with different DPI (64) 14.03.19 Release Total Commander 9.22 final (32/64) 12.03.19 Fixed: Copy hidden or system file with older default method (standard unchecked) -> no overwrite warning for hidden/system files for which the normal overwrite dialog was shown (32/64) 12.03.19 Fixed: Overwrite read only confirmation dialog may be shown in the middle of copying instead of at the end (32/64) 11.03.19 Fixed: Overwrite read only file while warning for read only was disabled but for hidden/system enabled -> still read only warning when using the expanded overwrite dialog (32/64) 11.03.19 Fixed: Thumbnail cache: Don't try to save uncompressed thumbnails when saving compressed fails (32/64) 10.03.19 Fixed: Copy hidden or system file with standard method (CopyFileEx) -> no overwrite warning, except when it also had the read only attribute. Can be overridden with OverwriteHidSysNotReadonly=1 (32/64) 08.03.19 Fixed: Possible crash in compiler library when window handle becomes invalid in main window message handler (64) 06.03.19 Release Total Commander 9.22 release candidate 2 (32/64) 06.03.19 Fixed: Copy in background: wait up to 5 seconds while mouse button is currently down, e.g. for drag&drop, then cancel operation with ESC to avoid lockup (32/64) 05.03.19 Fixed: Improved patch of unacev2.dll, also handling absolute paths (c:\ or \) in addition to relative ..\ (32) 03.03.19 Fixed: Lister: Press '4' while already using a single plugin, then '1' would not turn off that plugin (64) 03.03.19 Fixed: Lister: Hide percent when using internal media player (32/64) 27.02.19 Release Total Commander 9.22 release candidate 1 (32/64) 27.02.19 Fixed: String "Search result:" in drive label field wasn't updated when changing language (the fix also updates the current tab, but not other tabs) (32/64) 27.02.19 Fixed: Synchronize dirs: Do not warn if local dir contains 2 identical names with different case, e.g. a.txt and A.txt. However, sync functions are limited in this case (32/64) 27.02.19 Fixed: Ctrl+D, add directory to subfolder containing nested subfolders -> it wasn't added at the end of the subfolder, but before the first nested subfolder (32/64) 26.02.19 Fixed: Accessing tab with inaccessible network path can cause a hang when using IgnoreDirErrors=1 (32/64) 26.02.19 Fixed: After uploading zip file to virtual path (e.g. Android device), it could sometimes be opened internally by mistake (32/64) 26.02.19 Added: Included latest unrar dll 5.70.0 from www.rarlab.com (32/64) 22.02.19 Fixed: Handle directory traversal bug in unacev2.dll, affecting only the "unpack all" (Alt+F9) function (32) 17.02.19 Fixed: Shift+F4 dialog: Buttons "Tree" and "Cancel" were incorrect when using Cyrillic translation on English locale (32) 01.02.19 Fixed: Search: Detection of infinite loops in hard links/junctions/reparse points didn't always work (32/64) 23.01.19 Fixed: Couldn't drag directory from separate tree to empty space in tab header to add it (32/64) 21.01.19 Added: Always look in registry for key if no wincmd.key file is found in the supported locations (32/64) 21.01.19 Fixed: ZIP packer: ???? were shown instead of the name when packing to Unicode extra field, and verifying any Unicode mode (32/64) 14.01.19 Fixed: Directory history with shift+mouse wheel not working (64) 14.01.19 Fixed: Lister (F3), internal media player: Window size too small when viewing a lot of mp3 files, so the menu is broken into 2 lines (64) 14.01.19 Fixed: Lister (F3) was ticking the wrong codepage in the "Encoding" menu when opened (64) 14.01.19 Fixed: Folder tabs: when not using multiple lines for tabs, drag & drop of a tab to the opposite panel would add it to the source panel if it had hidden (scrolled) tabs under that position (32/64) 14.01.19 Fixed: Ignore X64Menu option on 32-bit Windows (32) 14.01.19 Fixed: When using X64Menu=1 in 64-bit version, the dialog in context menu - X32 - Configure was very small (64) 12.11.18 Fixed: ZIP packer: An incompressible file slightly smaller than 4GB, resulting in a compressed file >4GB appeared with a size of -1 in the created ZIP (but could still be unpacked) (32/64) 11.11.18 Fixed: Re-upload to FTP after editing now also works when the FTP connection is not displayed in one of the two panels, but still active (32/64) 11.11.18 Fixed: Compare by content, 2 files on the same FTP server but different user names -> edited file could be re-uploaded to the wrong server (32/64) 04.11.18 Fixed: Select all, switch between full and brief view mode: Entire list was scrolled slowly (64) 04.11.18 Fixed: FTP Upload/Download: Selection wasn't cleared when adding files to already opened background transfer manager with F5 - F2 (32/64) 04.11.18 Fixed: Header-encrypted RAR: Open archive, minimize+restore TC, try to unpack file, enter wrong password (remember password checked) -> user isn't asked again for the correct password (32/64) 30.10.18 Fixed: Dual screen, TC on the right screen: Search in separate process, maximize, minimize, restore -> search window had 0*0 pixel size (32/64) 01.10.18 Fixed: FTP error "Command in progress" in special case: Synchronize dirs, compare local dir with ftp, compare by content, edit remote file, save file, close compare tool, re-upload (32/64) 01.10.18 Fixed: Function to check file system links (junctions, reparse points) for infinite loops didn't handle relative paths created e.g. via "mklink /D MyDirLink ..\MyDir" while in directory "C:\MyDir" (32/64) 25.09.18 Fixed: Button bar: cd *.ext (to set custom filter) didn't support Unicode when using separate Left/Right menus (32/64) 24.09.18 Fixed: Multi-rename tool: [f] option didn't work for manually entered text, only for placeholders like [N] -> [f] is now applied for the entire text until the end or the next upper-/lowercase placeholder (32/64) 24.09.18 Fixed: Click on locked tab (directory changes not allowed) showed message about new tab when using TabEnterDirChange=2, but only if it was already the active tab (32) 24.09.18 Fixed: Click on locked tab (directory changes not allowed) showed message about new tab when using TabEnterDirChange=2 (64) 24.09.18 Fixed: Crash when starting external sync tool with /S=S parameter when PreventScrollbarCrash=1 was set (the default on Windows 8.1) (64) 24.09.18 Fixed: Search function: when going through list of old searches with up/down keys while the combobox was closed, the "RegEx" checkmark was only set, not removed (32/64) 24.09.18 Fixed: Search function: when going through list of old searches with up/down keys, the index reverted to the first item when a search with regular expression was encountered (64) 24.09.18 Fixed: Open archive with alternate packer via right click menu (internal association: **ext), then press Ctrl+B -> the default packer was now used (32/64) 23.09.18 Fixed: Crash viewing ICO files containing multiple PNG images (the problem seems to be re-using the TLazReaderPNG) (64) 23.09.18 Fixed: Search in archives by size wouldn't reliably find files >=2GBytes (32/64) 23.09.18 Fixed: Crash unpacking xz-packed zipx archives (because the necessary functions were missing from newer TCMDLZMA.DLL / TCLZMA64.DLL files) (32/64) 21.08.18 Release Total Commander 9.21a final (32/64) 18.08.18 Fixed: Compare by content: Disable button "Show only differences" during comparison, otherwise clicking it in the wrong moment could cause a crash (32/64) 16.08.18 Fixed: Ctrl+E and ESC (only with auto-complete+auto-append disabled) no longer worked in command line (32/64) 16.08.18 Fixed: Icons in menus: Selected items could no longer be shown as pressed buttons instead of checkmarks after saving icon options once (32/64) 15.08.18 Fixed: Crash when passing path to zip file to TC (e.g. from external Everything.exe), mostly on 64-bit (32/64) 15.08.18 Release Total Commander 9.21 final (32/64) 15.08.18 Fixed: Search in background: click on "Go to file" not going to files inside archives (64) 14.08.18 Fixed: FTP/FTPS via HTTP CONNECT proxy: Always send server name instead of IP address to proxy, also for data connections (can be overridden with SpecialFlags=1024) (32/64) 14.08.18 Fixed: Link overlay icons were shown for custom icons in file system plugin, e.g. for connections in SFTP (32) 13.08.18 Fixed: Crash in Lister when aborting text search with ESC (32) 13.08.18 Fixed: FTPS via HTTP CONNECT proxy: Reading directory not working after uploading a file (32/64) 10.08.18 Fixed: FTP/file system plugins: Log function could suddenly stop logging (32/64) 10.08.18 Fixed: Alt+F1, Alt+F2 drive dropdown combobox: No drive was shown after closing list with ESC (problem caused by Korean text input fix - needs to be applied to editable comboboxes only) (64) 10.08.18 Fixed: Any tree view: Icons to expand/collapse tree branches were wrong on some high DPI devices (32) 10.08.18 Fixed: Ctrl+F FTP connections: Folder icons were not displayed on high DPI screens when the file list icon size was changed (e.g. to 24x24) (32/64) 09.08.18 Fixed: Configuration - Options - Icons: Applying "Show drive icons from Explorer" didn't update Network Neighborhood, Computer and My Documents icons until after restarting TC (32/64) 08.08.18 Release Total Commander 9.21 release candidate 3 (32/64) 08.08.18 Fixed: FTP: Auto-reconnect when the connection is lost while uploading/downloading many empty directories recursively (32/64) 07.08.18 Fixed: Updated to latest unrar.dll 5.60.0 from www.rarlab.com, and latest tcmdlzma.dll (18.05) from 7-zip.org (32/64) 07.08.18 Fixed: Search function: Buttons below the search result couldn't be reached with Tab key, only with mouse or hotkeys (32/64) 07.08.18 Fixed: When using IgnoreDirErrors=1, don't show dialog to connect to network share twice, e.g. when changing to a network tab (32/64) 07.08.18 Fixed: When using IgnoreDirErrors=1, wait with connecting to UNC path \\server\share while nag dialog (with 1-2-3 buttons) is displayed (32/64) 07.08.18 Fixed: Keep nag dialog (with 1-2-3 buttons) usable and focused when dialog to connect to computer on the network (\\servername) is shown below it (32/64) 06.08.18 Fixed: Button bar: Button highlights (not pressed, hovered) not always disappearing after moving mouse away, e.g. after Alt+Shift+F11 (32/64) 03.08.18 Fixed: DPI dependent main menu icon sizes were not saved in resolution-specific section, loading worked fine (64) 01.08.18 Release Total Commander 9.21 release candidate 2 (32/64) 01.08.18 Fixed: Moved DPI dependent main menu icon sizes from [Configuration] to resolution-specific section for full multiple screen support, e.g. to [1920x1080 (16x20)] (32/64) 01.08.18 Fixed: Button bar, start menu parameters: %M added .. for updir item, but only when used in combination with %T (32/64) 01.08.18 Fixed: FTP: Auto-reconnect when the connection is lost while uploading recursively (32/64) 01.08.18 Fixed: Configuration - Options - Misc - Hotkey dropdown combobox: ESC now keeps the last chosen hotkey also on Windows 7 (32/64) 01.08.18 Fixed: Configuration - Options - Misc - Hotkey dropdown combobox: Do not open help on F1 (32/64) 01.08.18 Fixed: FTP: Auto-reconnect when the connection is lost while reading a subdirectory when downloading recursively (32/64) 01.08.18 Fixed: FTP: Dialog box "Not connected!" was shown as independent window without parent when TC wasn't in the foreground (32/64) 01.08.18 Fixed: Ctrl+Q: Focus went from active panel to quick view panel after switching away from TC and back, but only when ActiveTitle was set in wincmd.ini (32/64) 31.07.18 Fixed: Handle structured exceptions within wcmzip64.dll to prevent crashes with thumbnail packing (64) 30.07.18 Fixed: Problems with descript.ion files using UTF-8: Upper/lowercase conversion was incorrect, so comments were not picked up when accented characters had different case. Also caused problems with special characters on Chinese locale (32/64) 29.07.18 Fixed: Search with "Everything": Put regular expressions in double quotes, e.g. user enters ^(ABC|BCD) and checks "RegEx" and "Everything" -> send regex:"^(ABC|BCD)" (32/64) 29.07.18 Fixed: When closing some dialogs with ESC, e.g. FTP connection details, the dialog would disappear, and briefly re-appear before disappearing again (64) 29.07.18 Fixed: Distinguish between empty environment variables and non-existing environment variables. Replace %variable% with empty string in the first case (32/64) 25.07.18 Release Total Commander 9.21 release candidate 1 (32/64) 25.07.18 Added: Use smaller 16x16 link overlay icon (32/64) 25.07.18 Added: wincmd.ini [Configuration] PreventScrollbarCrash= enable function to prevent crash when loading Lister multiple times manually (32/64) 25.07.18 Fixed: Prevent crash when loading Lister multiple times also on Windows Server 2016 (32/64) 24.07.18 Added: wcx_ftp.ini [General] ReturnToReUploadDir=0 Set to 1 to automatically return to the directory to which an edited remote file was re-uploaded when saved (32/64) 20.07.18 Fixed: Crash in FTP connection details (Ctrl+F - Edit) in case of problems with user certificate store (32/64) 18.07.18 Added: Also show png images in addition to icons from ico/dll/exe files defined in file associations (32/64) 18.07.18 Fixed: All combobox controls: When entering Korean text and the last entered character is incomplete, clicking on another control inserted that character at the start of the control (32/64) 17.07.18 Fixed: Prevent flickering about 1 second after starting on Windows 7 (which was sending a WM_THEMECHANGED notification although the theme didn't change) (32) 17.07.18 Fixed: With option "Select only the filename when renaming" set, the name+extension were still selected when pressing down arrow on last file in list (32/64) 17.07.18 Fixe
Emails

ftp://user:[email protected]/path/

<[email protected]>

URLs

https

https://www.7-zip.org/sdk.html

https://msdn.microsoft.com/en-us/library/windows/desktop/dd378457.aspx

http-equiv="Content-Type">

http

https/ftps

http://bugs.freepascal.org/view.php?id=17280

http-equiv="Content-type"

http://www.hardtoc.com/archives/198

http://msdn.microsoft.com/en-us/library/dd318693%28VS.85%29.aspx

http://www.ghisler.com/strace.zip

http://buglist.jrsoftware.org/generated/entry0686.htm

http://anso.da.ru

Signatures

  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://dl.malwarewatch.org/software/useful/TotalCommander.zip
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:100
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850d74f50,0x7ff850d74f60,0x7ff850d74f70
      2⤵
        PID:4428
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1584 /prefetch:2
        2⤵
          PID:4600
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4524
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:8
          2⤵
            PID:1884
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
            2⤵
              PID:1944
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
              2⤵
                PID:1192
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:8
                2⤵
                  PID:736
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3692
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:8
                  2⤵
                    PID:2096
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4404 /prefetch:2
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1552
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=892 /prefetch:8
                    2⤵
                      PID:4388
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:8
                      2⤵
                        PID:384
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=976 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1240
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3712
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5164 /prefetch:8
                        2⤵
                          PID:4788
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:8
                          2⤵
                            PID:4016
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2292
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:8
                            2⤵
                              PID:2256
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:8
                              2⤵
                                PID:3580
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
                                2⤵
                                  PID:3452
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
                                  2⤵
                                    PID:5116
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
                                    2⤵
                                      PID:1304
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 /prefetch:8
                                      2⤵
                                        PID:4580
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:8
                                        2⤵
                                          PID:1140
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:2188
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
                                          1⤵
                                          • Drops file in Program Files directory
                                          PID:1444
                                          • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe
                                            "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={9d60985d-e139-4714-bb71-6c3edc5ffef5} --system
                                            2⤵
                                            • Executes dropped EXE
                                            PID:3916
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:1796
                                          • C:\Users\Admin\Downloads\TotalCommander\Total Commander.exe
                                            "C:\Users\Admin\Downloads\TotalCommander\Total Commander.exe"
                                            1⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            PID:1556
                                          • C:\totalcmd\TOTALCMD64.EXE
                                            "C:\totalcmd\TOTALCMD64.EXE"
                                            1⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Enumerates connected drives
                                            • Suspicious use of FindShellTrayWindow
                                            PID:1820
                                          • C:\totalcmd\TOTALCMD64.EXE
                                            "C:\totalcmd\TOTALCMD64.EXE"
                                            1⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Enumerates connected drives
                                            • Suspicious use of FindShellTrayWindow
                                            PID:3872

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe

                                            Filesize

                                            253KB

                                            MD5

                                            49ac3c96d270702a27b4895e4ce1f42a

                                            SHA1

                                            55b90405f1e1b72143c64113e8bc65608dd3fd76

                                            SHA256

                                            82aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f

                                            SHA512

                                            b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3

                                            Filesize

                                            141KB

                                            MD5

                                            ea1c1ffd3ea54d1fb117bfdbb3569c60

                                            SHA1

                                            10958b0f690ae8f5240e1528b1ccffff28a33272

                                            SHA256

                                            7c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d

                                            SHA512

                                            6c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf

                                          • C:\Users\Admin\AppData\Roaming\GHISLER\wincmd.ini

                                            Filesize

                                            41B

                                            MD5

                                            926eb45a00d3c2c4afef6ce8ac07691b

                                            SHA1

                                            2ec963e72f8268b08dfb24e9071e10017d0f28d5

                                            SHA256

                                            bf16fb4bac9923e4327e3dd4f8398f0996b7395509123830f52a9b6ef66e3467

                                            SHA512

                                            dce58e3b553143be5613a49748ebb0b479dcf3d21f156cefce6614bc66e1bc4c9273c02454f8bb28b3da5cd9333474091f65c374564d80cb4212561f903c86e3

                                          • C:\Users\Admin\AppData\Roaming\GHISLER\wincmd.ini

                                            Filesize

                                            595B

                                            MD5

                                            206889e79a0d30c049d56c0e72761e78

                                            SHA1

                                            6600623329334f3c3ffbee4f7cbfa2a82ef47e65

                                            SHA256

                                            99bc826eff7aa2f43ed65180e3aa32fd9dab59889f9895876bc93197f548674f

                                            SHA512

                                            e6e51e20162eeb0ac7b43efa6a47fe24daea2ab9f6960530da629325f5365d13b05f702635b955fdb52afb9afca1647d3987d5233541627f3b0bb54ba28236f3

                                          • C:\totalcmd\TOTALCMD64.EXE

                                            Filesize

                                            8.5MB

                                            MD5

                                            5651e23e63ba23821c2ac8cd38d54593

                                            SHA1

                                            5f731e30733ef0371dc3a82240c918da73cfc041

                                            SHA256

                                            600d3bf7766ef846db0b8c17971fc5c77d5b37f7b3ae77220e20e752624ef4ef

                                            SHA512

                                            c5a8c18fdaa954bbd9831f3d71b65fcd3a43314f1727a8d9376da7a4babfcaa2391e568f3dfa474617161fd4ed655e407921b02ff7c59d42051fe8043080eae8

                                          • C:\totalcmd\TOTALCMD64.EXE

                                            Filesize

                                            8.5MB

                                            MD5

                                            5651e23e63ba23821c2ac8cd38d54593

                                            SHA1

                                            5f731e30733ef0371dc3a82240c918da73cfc041

                                            SHA256

                                            600d3bf7766ef846db0b8c17971fc5c77d5b37f7b3ae77220e20e752624ef4ef

                                            SHA512

                                            c5a8c18fdaa954bbd9831f3d71b65fcd3a43314f1727a8d9376da7a4babfcaa2391e568f3dfa474617161fd4ed655e407921b02ff7c59d42051fe8043080eae8

                                          • C:\totalcmd\TOTALCMD64.EXE

                                            Filesize

                                            8.5MB

                                            MD5

                                            5651e23e63ba23821c2ac8cd38d54593

                                            SHA1

                                            5f731e30733ef0371dc3a82240c918da73cfc041

                                            SHA256

                                            600d3bf7766ef846db0b8c17971fc5c77d5b37f7b3ae77220e20e752624ef4ef

                                            SHA512

                                            c5a8c18fdaa954bbd9831f3d71b65fcd3a43314f1727a8d9376da7a4babfcaa2391e568f3dfa474617161fd4ed655e407921b02ff7c59d42051fe8043080eae8

                                          • C:\totalcmd\default.bar

                                            Filesize

                                            977B

                                            MD5

                                            f103b23c658d801d5c31cb056bafdc16

                                            SHA1

                                            8de136fc1dd6372b4eb357304c73eb55393bba13

                                            SHA256

                                            8159c946398eec59d8065342c06b957ae38165e664850fb57f5d9971cffb7c21

                                            SHA512

                                            a4edb8541eea5fcb6411c59ee604304324aea37e7d0cfc271faf0f8bd044f93282d14c54168e355f59ccd81ad679c2f3cf4cd65dc5b22c6ed4ce6f160beb1cd3

                                          • C:\totalcmd\default.br2

                                            Filesize

                                            20KB

                                            MD5

                                            3a6b27edadab326bbe5d47e0eb6dcaae

                                            SHA1

                                            6dcbd84131375612b13503e3b65e17f04bceb0ef

                                            SHA256

                                            6842ab1e7e498e3eb015e92acdf09daf95b480d48f6f3b5f3256dfb277690ed6

                                            SHA512

                                            062c6aaccba2dec42da3c1e89011aae25a16b2a1e28c2518fd38bf64e2a8d682761006e6e085d3f34a6d3500841cb347586699f9e1c1fb9eb3dd2ee3cda7bb99

                                          • C:\totalcmd\totalcmd.inc

                                            Filesize

                                            25KB

                                            MD5

                                            aa0c7c1d4a453a5f1088db0fb10cc91f

                                            SHA1

                                            2754f5e269ff285268b7b819cd67ef8861ec8e6e

                                            SHA256

                                            42bbe67581a6cba05a39dd0e843e4443e0883c69530b889d7e47941c7fd3923b

                                            SHA512

                                            3ff79a5f5c3d340ce22b34bf22867d5feedd0aba6757815c410cffaf00cfdfe64921cc645fac2f46ebf5a2546d6f00a1e955cd4d0067bd92e8ac75b46802247c

                                          • C:\totalcmd\vertical.bar

                                            Filesize

                                            417B

                                            MD5

                                            359a5959600405bafe7f527698403fd5

                                            SHA1

                                            4024b741ec3a894123436c20d92e742d2c5549e8

                                            SHA256

                                            2269161181abceb488f93ed7a52e81900d3217d0da4cd3fe7cd405b7658d814a

                                            SHA512

                                            04af487a7c3a680effdad2ac34881312863a8c1fd5f02d651440a749672972e081b63bc715f0048639618c323377295201195c2b893f5748fe936568282f8ac6

                                          • C:\totalcmd\vertical.br2

                                            Filesize

                                            6KB

                                            MD5

                                            708da336eca1f69565cb10092e6b654f

                                            SHA1

                                            4e7b674dd94e69b9d6dc2d9f703f68363b22fbe0

                                            SHA256

                                            5b838143eb9ebd92177e583fd6e247730c06606fe75cbe93751b51e33b1c3495

                                            SHA512

                                            86748c8eb868ecb7f0a66c5762574a19c8f8ac82f8502d547dfdb4533ec2127779ebad3256f1a289aeb2b1f6d6d8e88a334998995d01426ca554a6a839041c32

                                          • C:\totalcmd\wcmicon2.dll

                                            Filesize

                                            1.5MB

                                            MD5

                                            a62b33507ef138e251e1a530d91824ee

                                            SHA1

                                            faa7ca809e4b5915c1918b1864394eb7a5791ca6

                                            SHA256

                                            4e8c92b0bf809b3c9d54ab3ce8820ecb70f394ebc7e2e9089d1ca8d862201725

                                            SHA512

                                            636db3687815999e2177f34f8defb60a1a331fac398fa26f68c7f2fc65c9d8107f2efeed3875a7ca55950cb4a23b541b288b2f452ce40beea3fda4f61d6c209c

                                          • C:\totalcmd\wcmicons.dll

                                            Filesize

                                            624KB

                                            MD5

                                            326060071ef65a79744d1b813f244a05

                                            SHA1

                                            4748a79ce0a930ed575b3503fde4871b53103bc2

                                            SHA256

                                            c7927522743294ca3193dba7afb3786ba423e18230db640084b24aaf21554c6f

                                            SHA512

                                            b3b1ed8c5027b362d9e923325b5af1b8e8c773e0012f77cf19e933e796187cfc7b3c4a95a71ba7e94c18b1b0244bfce712e319328022699b44afd56e51dab03f

                                          • C:\totalcmd\wcmicons.inc

                                            Filesize

                                            1KB

                                            MD5

                                            ee007fe2c0767d99ea41dc14053cb087

                                            SHA1

                                            df9dc7bf96408b20bc426466f25c5d4979793f7a

                                            SHA256

                                            a2aa6a6a622331ef483d7cf144b3e676a4699fdcdfb101b4ff3c6a7ef294d437

                                            SHA512

                                            53c8d972dcd2b8c4e08e2b89adaa8f969ae4d79ee97acf47fc8f625fecb632fa3db0369b63db6bb47103601f960030dd9211f00c1e064e82f4c814268ffae43a