012df00a6c8445074efa5c68506965c652c5ba4a5c3108bb80e7ae832e423ff6

Analysis

max time kernel
148s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20250313-uk
resource tags

arch:x64arch:x86image:win11-20250313-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
28/03/2025, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TMmap_x1.0.4.4_D24.48.msi
Size

55.9MB
MD5

25258c327b220ef38c6c094fb8f2c002
SHA1

3b9e36c0f290a0a56ff868dc7796601c4c800d28
SHA256

012df00a6c8445074efa5c68506965c652c5ba4a5c3108bb80e7ae832e423ff6
SHA512

77a7c11879d9955fb27a9caf7685d425b5604566f248f335042942fbf3f6b9db9006bfd6761796a3bf2ab8ceb24290d8276dac6c2d1b7675c9090ea92c202a13
SSDEEP

1572864:BD0yC8/alZeUUtMqe0CUTN6bZ2ctu777VMT4I8SSS7oEIT+Yu:BDz/alZ9Uk5UTNktuPZMT4IAPEHx

Score

6^/10

discovery link pdf persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	5388	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TMSoft\TMmap\WeifenLuo.WinFormsUI.Docking.ThemeVS2015.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\MObj.db3	msiexec.exe
File opened for modification	C:\Program Files (x86)\TMSoft\TMmap\Data\MObj.db3	TMmap.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\x64\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\DocumentFormat.OpenXml.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\ClientLKProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMmap.exe	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMSharpMapControl.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Border.frs	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\HighlightIcons.frs	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\CerImporter.exe	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMmapHelp_uk.pdf	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMSoft.TicketServer.MapClient.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\uk-UA\TMmap.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Microsoft.SqlServer.Types.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\ru-RU\TMmap.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\CountryNames.frs	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Stations.frs	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\License_ru.pdf	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.DataVisualization.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\NetTopologySuite.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\SpatialRefSys.xml	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.ProcessingObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\MultiColumnTreeExt.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\PrivacyPolicy_ru.pdf	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\AppUpdateProviderContracts_V2.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Template.dat	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\CompoundLineSymbolizer.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TariffProviderContracts.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\GroupIcons.frs	msiexec.exe
File opened for modification	C:\Program Files (x86)\TMSoft\TMmap\Data\TMmap.db3	TMmap.exe
File opened for modification	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Template.dat	TMmap.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Common.Logging.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\FileStorage.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMmapHelp_ru.pdf	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Color.dat	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMmap.db3	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\GeoAPI.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.WinForms.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\AppCopyUpdater.exe	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMSoft.ITicketServer.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\WeifenLuo.WinFormsUI.Docking.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Config.dat	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\PowerCollections.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\ProjNet.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\License_uk.pdf	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMLogger.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Common.Logging.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\SharpMap.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TMSharpMapControl.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\tmdoc.chm	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\TariffTestCommon.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Water.frs	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\PrivacyPolicy_uk.pdf	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\AppUpdateClient_V2.dll	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\LayerIndex.dat	msiexec.exe
File created	C:\Program Files (x86)\TMSoft\TMmap\Data\TMmap.user.inst	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57b076.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1DB.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB1DB.tmp-\TMmapSetup_WixSharp.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBA00.tmp-\TMmapSetup_WixSharp.exe	rundll32.exe
File created	C:\Windows\SystemTemp\~DFAB71139234D3229B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b074.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{884F2954-9EB0-4235-B910-C1264E6245ED}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF394050E4C202824.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB567.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB645.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA00.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DF6AD538D470CE2DE4.TMP	msiexec.exe
File created	C:\Windows\Installer\e57b074.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1DB.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA00.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBA00.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB1DB.tmp-\WixSharp.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF35731D222FDD4056.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB537.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB597.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB1A.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	TMmap.exe

HTTP links in PDF interactive object 2 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x001900000002b3e3-191.dat	pdf_with_link_action
behavioral1/files/0x001900000002b3e2-190.dat	pdf_with_link_action

Loads dropped DLL 22 IoCs

pid	Process
228	MsiExec.exe
4772	MsiExec.exe
4788	rundll32.exe
4788	rundll32.exe
4788	rundll32.exe
4788	rundll32.exe
4788	rundll32.exe
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
4412	rundll32.exe
4412	rundll32.exe
4412	rundll32.exe
4412	rundll32.exe
4412	rundll32.exe
4412	rundll32.exe
4412	rundll32.exe
3088	MsiExec.exe
1956	TMmap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5388	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d78eac4ea3e6401f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d78eac4e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d78eac4e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd78eac4e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d78eac4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	TMmap.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	TMmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\PackageCode = "3B921DF21E30B6041BAF44622AAA01D9"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	TMmap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	TMmap.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\Version = "16777260"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	TMmap.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	TMmap.exe
Key created	\Registry\User\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\NotificationData	TMmap.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	TMmap.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	TMmap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	TMmap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4592F4880BE953249B011C62E42654DE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\Language = "1058"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	TMmap.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	TMmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4592F4880BE953249B011C62E42654DE\Complete	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList\PackageName = "TMmap_x1.0.4.4_D24.48.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings	TMmap.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	TMmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\ProductName = "TMmap"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	TMmap.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	TMmap.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\58D9D834E26701B47861585E67924751	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	TMmap.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	TMmap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	TMmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\58D9D834E26701B47861585E67924751\4592F4880BE953249B011C62E42654DE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4592F4880BE953249B011C62E42654DE\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1216697136-3907990103-1733992739-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	TMmap.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E091882E958EE48842C550A71C69A1A0DC548F40\Blob = 190000000100000010000000f55e8ba34649e3e6a072bf6f8947ba351400000001000000140000008cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae030000000100000014000000e091882e958ee48842c550a71c69a1a0dc548f400b000000010000003800000054004d004b006100720074006100500072006f006400430041002e006300650072005f0077006900780043006500720074005f00310000000f0000000100000020000000923095e19220418293796ebb659024228925b27ec6741c12b941082c72049fe70400000001000000100000001227ab30a7bab8f10eb8f23b10566f3c2000000001000000310400003082042d30820315a00302010202090084774ea9d9d66c6a300d06092a864886f70d01010b0500306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d301e170d3139313030343133343035345a170d3339313030343133343035345a306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100db6584d6cc508497bd8ae1f02e92c58808bee5d7a6265f13f1dcbb8686b57b7797120203452fa8b31394b15c780a0aa8b93bae9b38503613ad74d5c52e7a65cfe12b18c4cb87447919683a0c1707fc7bb28c1e7f18b7c16af971470ea80869a52aef037530eb516d20f80d85a3f0fbaa5ed88976b2e9071dad0dc1e5e198db21f8659389024b05a353d0bfc26118779a6ebc5591fb4f757c57cb499248fb1c113e66a24e4c6630e85b8d2fcade616a22fa1f9bc8927c7079326f77cf4a4053bca4dd6081286b72cc8dad31c2e48be2b4b8e88c2f399de3f1300fe2ca778c127b196811fd4bb3c2f4a43cb94d6a5cdc20e540696fde3ce92f8679b120db47fc190203010001a381d13081ce301d0603551d0e041604148cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae30819e0603551d2304819630819380148cdd5bdae1c67a0ca72e9e2c9e57e85f005829aea170a46e306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d82090084774ea9d9d66c6a300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010042e842751d850c87fab60ae80c6295d9042859550466e1f00b426b998cef6de3d7df8c8178c9ea620b9154708b52cf8d894ea6426ee106c865ff2daf3268c310c2acd71f7de8ac1f7e089b463c630a6cde955774f5d97e76d4b2de9e345fb2f93bf86e4652eaca73f1b1c3650961490d977af2eeb7c1c2d8fb2ba144618f287fad0485c92f103edd9afb04711e45f3326a65391b313f2187972e75100e2d65cdf0f70ced050ce560101d4a605cf43bfc6c73cb5b44d50b556c0e7d6ec2b2f6de4f75da55c224825caa35e51e6c72ca56b661405ac71790561864f849332dfba62d19e67b7c325b2cd19fc493ce4b28f429f577538fd4189fd8c756d252a981fe	TMmap.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E091882E958EE48842C550A71C69A1A0DC548F40\Blob = 5c0000000100000004000000000800000400000001000000100000001227ab30a7bab8f10eb8f23b10566f3c0f0000000100000020000000923095e19220418293796ebb659024228925b27ec6741c12b941082c72049fe70b000000010000003800000054004d004b006100720074006100500072006f006400430041002e006300650072005f0077006900780043006500720074005f0031000000030000000100000014000000e091882e958ee48842c550a71c69a1a0dc548f401400000001000000140000008cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae190000000100000010000000f55e8ba34649e3e6a072bf6f8947ba352000000001000000310400003082042d30820315a00302010202090084774ea9d9d66c6a300d06092a864886f70d01010b0500306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d301e170d3139313030343133343035345a170d3339313030343133343035345a306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100db6584d6cc508497bd8ae1f02e92c58808bee5d7a6265f13f1dcbb8686b57b7797120203452fa8b31394b15c780a0aa8b93bae9b38503613ad74d5c52e7a65cfe12b18c4cb87447919683a0c1707fc7bb28c1e7f18b7c16af971470ea80869a52aef037530eb516d20f80d85a3f0fbaa5ed88976b2e9071dad0dc1e5e198db21f8659389024b05a353d0bfc26118779a6ebc5591fb4f757c57cb499248fb1c113e66a24e4c6630e85b8d2fcade616a22fa1f9bc8927c7079326f77cf4a4053bca4dd6081286b72cc8dad31c2e48be2b4b8e88c2f399de3f1300fe2ca778c127b196811fd4bb3c2f4a43cb94d6a5cdc20e540696fde3ce92f8679b120db47fc190203010001a381d13081ce301d0603551d0e041604148cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae30819e0603551d2304819630819380148cdd5bdae1c67a0ca72e9e2c9e57e85f005829aea170a46e306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d82090084774ea9d9d66c6a300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010042e842751d850c87fab60ae80c6295d9042859550466e1f00b426b998cef6de3d7df8c8178c9ea620b9154708b52cf8d894ea6426ee106c865ff2daf3268c310c2acd71f7de8ac1f7e089b463c630a6cde955774f5d97e76d4b2de9e345fb2f93bf86e4652eaca73f1b1c3650961490d977af2eeb7c1c2d8fb2ba144618f287fad0485c92f103edd9afb04711e45f3326a65391b313f2187972e75100e2d65cdf0f70ced050ce560101d4a605cf43bfc6c73cb5b44d50b556c0e7d6ec2b2f6de4f75da55c224825caa35e51e6c72ca56b661405ac71790561864f849332dfba62d19e67b7c325b2cd19fc493ce4b28f429f577538fd4189fd8c756d252a981fe	TMmap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E091882E958EE48842C550A71C69A1A0DC548F40	TMmap.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E091882E958EE48842C550A71C69A1A0DC548F40\Blob = 0f0000000100000020000000923095e19220418293796ebb659024228925b27ec6741c12b941082c72049fe70b000000010000003800000054004d004b006100720074006100500072006f006400430041002e006300650072005f0077006900780043006500720074005f0031000000030000000100000014000000e091882e958ee48842c550a71c69a1a0dc548f402000000001000000310400003082042d30820315a00302010202090084774ea9d9d66c6a300d06092a864886f70d01010b0500306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d301e170d3139313030343133343035345a170d3339313030343133343035345a306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100db6584d6cc508497bd8ae1f02e92c58808bee5d7a6265f13f1dcbb8686b57b7797120203452fa8b31394b15c780a0aa8b93bae9b38503613ad74d5c52e7a65cfe12b18c4cb87447919683a0c1707fc7bb28c1e7f18b7c16af971470ea80869a52aef037530eb516d20f80d85a3f0fbaa5ed88976b2e9071dad0dc1e5e198db21f8659389024b05a353d0bfc26118779a6ebc5591fb4f757c57cb499248fb1c113e66a24e4c6630e85b8d2fcade616a22fa1f9bc8927c7079326f77cf4a4053bca4dd6081286b72cc8dad31c2e48be2b4b8e88c2f399de3f1300fe2ca778c127b196811fd4bb3c2f4a43cb94d6a5cdc20e540696fde3ce92f8679b120db47fc190203010001a381d13081ce301d0603551d0e041604148cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae30819e0603551d2304819630819380148cdd5bdae1c67a0ca72e9e2c9e57e85f005829aea170a46e306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d82090084774ea9d9d66c6a300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010042e842751d850c87fab60ae80c6295d9042859550466e1f00b426b998cef6de3d7df8c8178c9ea620b9154708b52cf8d894ea6426ee106c865ff2daf3268c310c2acd71f7de8ac1f7e089b463c630a6cde955774f5d97e76d4b2de9e345fb2f93bf86e4652eaca73f1b1c3650961490d977af2eeb7c1c2d8fb2ba144618f287fad0485c92f103edd9afb04711e45f3326a65391b313f2187972e75100e2d65cdf0f70ced050ce560101d4a605cf43bfc6c73cb5b44d50b556c0e7d6ec2b2f6de4f75da55c224825caa35e51e6c72ca56b661405ac71790561864f849332dfba62d19e67b7c325b2cd19fc493ce4b28f429f577538fd4189fd8c756d252a981fe	TMmap.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E091882E958EE48842C550A71C69A1A0DC548F40\Blob = 1400000001000000140000008cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae030000000100000014000000e091882e958ee48842c550a71c69a1a0dc548f400b000000010000003800000054004d004b006100720074006100500072006f006400430041002e006300650072005f0077006900780043006500720074005f00310000000f0000000100000020000000923095e19220418293796ebb659024228925b27ec6741c12b941082c72049fe72000000001000000310400003082042d30820315a00302010202090084774ea9d9d66c6a300d06092a864886f70d01010b0500306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d301e170d3139313030343133343035345a170d3339313030343133343035345a306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100db6584d6cc508497bd8ae1f02e92c58808bee5d7a6265f13f1dcbb8686b57b7797120203452fa8b31394b15c780a0aa8b93bae9b38503613ad74d5c52e7a65cfe12b18c4cb87447919683a0c1707fc7bb28c1e7f18b7c16af971470ea80869a52aef037530eb516d20f80d85a3f0fbaa5ed88976b2e9071dad0dc1e5e198db21f8659389024b05a353d0bfc26118779a6ebc5591fb4f757c57cb499248fb1c113e66a24e4c6630e85b8d2fcade616a22fa1f9bc8927c7079326f77cf4a4053bca4dd6081286b72cc8dad31c2e48be2b4b8e88c2f399de3f1300fe2ca778c127b196811fd4bb3c2f4a43cb94d6a5cdc20e540696fde3ce92f8679b120db47fc190203010001a381d13081ce301d0603551d0e041604148cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae30819e0603551d2304819630819380148cdd5bdae1c67a0ca72e9e2c9e57e85f005829aea170a46e306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d82090084774ea9d9d66c6a300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010042e842751d850c87fab60ae80c6295d9042859550466e1f00b426b998cef6de3d7df8c8178c9ea620b9154708b52cf8d894ea6426ee106c865ff2daf3268c310c2acd71f7de8ac1f7e089b463c630a6cde955774f5d97e76d4b2de9e345fb2f93bf86e4652eaca73f1b1c3650961490d977af2eeb7c1c2d8fb2ba144618f287fad0485c92f103edd9afb04711e45f3326a65391b313f2187972e75100e2d65cdf0f70ced050ce560101d4a605cf43bfc6c73cb5b44d50b556c0e7d6ec2b2f6de4f75da55c224825caa35e51e6c72ca56b661405ac71790561864f849332dfba62d19e67b7c325b2cd19fc493ce4b28f429f577538fd4189fd8c756d252a981fe	TMmap.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E091882E958EE48842C550A71C69A1A0DC548F40\Blob = 0400000001000000100000001227ab30a7bab8f10eb8f23b10566f3c0f0000000100000020000000923095e19220418293796ebb659024228925b27ec6741c12b941082c72049fe70b000000010000003800000054004d004b006100720074006100500072006f006400430041002e006300650072005f0077006900780043006500720074005f0031000000030000000100000014000000e091882e958ee48842c550a71c69a1a0dc548f401400000001000000140000008cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae2000000001000000310400003082042d30820315a00302010202090084774ea9d9d66c6a300d06092a864886f70d01010b0500306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d301e170d3139313030343133343035345a170d3339313030343133343035345a306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100db6584d6cc508497bd8ae1f02e92c58808bee5d7a6265f13f1dcbb8686b57b7797120203452fa8b31394b15c780a0aa8b93bae9b38503613ad74d5c52e7a65cfe12b18c4cb87447919683a0c1707fc7bb28c1e7f18b7c16af971470ea80869a52aef037530eb516d20f80d85a3f0fbaa5ed88976b2e9071dad0dc1e5e198db21f8659389024b05a353d0bfc26118779a6ebc5591fb4f757c57cb499248fb1c113e66a24e4c6630e85b8d2fcade616a22fa1f9bc8927c7079326f77cf4a4053bca4dd6081286b72cc8dad31c2e48be2b4b8e88c2f399de3f1300fe2ca778c127b196811fd4bb3c2f4a43cb94d6a5cdc20e540696fde3ce92f8679b120db47fc190203010001a381d13081ce301d0603551d0e041604148cdd5bdae1c67a0ca72e9e2c9e57e85f005829ae30819e0603551d2304819630819380148cdd5bdae1c67a0ca72e9e2c9e57e85f005829aea170a46e306c310b3009060355040613025541310d300b06035504070c044b69657631133011060355040a0c0a544d536f6674204c74643118301606035504030c0f544d4b617274612050726f64204341311f301d06092a864886f70d0109011610696e666f40746d6b617274612e636f6d82090084774ea9d9d66c6a300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010042e842751d850c87fab60ae80c6295d9042859550466e1f00b426b998cef6de3d7df8c8178c9ea620b9154708b52cf8d894ea6426ee106c865ff2daf3268c310c2acd71f7de8ac1f7e089b463c630a6cde955774f5d97e76d4b2de9e345fb2f93bf86e4652eaca73f1b1c3650961490d977af2eeb7c1c2d8fb2ba144618f287fad0485c92f103edd9afb04711e45f3326a65391b313f2187972e75100e2d65cdf0f70ced050ce560101d4a605cf43bfc6c73cb5b44d50b556c0e7d6ec2b2f6de4f75da55c224825caa35e51e6c72ca56b661405ac71790561864f849332dfba62d19e67b7c325b2cd19fc493ce4b28f429f577538fd4189fd8c756d252a981fe	TMmap.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3432	msiexec.exe
3432	msiexec.exe
1956	TMmap.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	TMmap.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5388	msiexec.exe
Token: SeSecurityPrivilege	3432	msiexec.exe
Token: SeCreateTokenPrivilege	5388	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5388	msiexec.exe
Token: SeLockMemoryPrivilege	5388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5388	msiexec.exe
Token: SeMachineAccountPrivilege	5388	msiexec.exe
Token: SeTcbPrivilege	5388	msiexec.exe
Token: SeSecurityPrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeLoadDriverPrivilege	5388	msiexec.exe
Token: SeSystemProfilePrivilege	5388	msiexec.exe
Token: SeSystemtimePrivilege	5388	msiexec.exe
Token: SeProfSingleProcessPrivilege	5388	msiexec.exe
Token: SeIncBasePriorityPrivilege	5388	msiexec.exe
Token: SeCreatePagefilePrivilege	5388	msiexec.exe
Token: SeCreatePermanentPrivilege	5388	msiexec.exe
Token: SeBackupPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeShutdownPrivilege	5388	msiexec.exe
Token: SeDebugPrivilege	5388	msiexec.exe
Token: SeAuditPrivilege	5388	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5388	msiexec.exe
Token: SeChangeNotifyPrivilege	5388	msiexec.exe
Token: SeRemoteShutdownPrivilege	5388	msiexec.exe
Token: SeUndockPrivilege	5388	msiexec.exe
Token: SeSyncAgentPrivilege	5388	msiexec.exe
Token: SeEnableDelegationPrivilege	5388	msiexec.exe
Token: SeManageVolumePrivilege	5388	msiexec.exe
Token: SeImpersonatePrivilege	5388	msiexec.exe
Token: SeCreateGlobalPrivilege	5388	msiexec.exe
Token: SeCreateTokenPrivilege	5388	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5388	msiexec.exe
Token: SeLockMemoryPrivilege	5388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5388	msiexec.exe
Token: SeMachineAccountPrivilege	5388	msiexec.exe
Token: SeTcbPrivilege	5388	msiexec.exe
Token: SeSecurityPrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeLoadDriverPrivilege	5388	msiexec.exe
Token: SeSystemProfilePrivilege	5388	msiexec.exe
Token: SeSystemtimePrivilege	5388	msiexec.exe
Token: SeProfSingleProcessPrivilege	5388	msiexec.exe
Token: SeIncBasePriorityPrivilege	5388	msiexec.exe
Token: SeCreatePagefilePrivilege	5388	msiexec.exe
Token: SeCreatePermanentPrivilege	5388	msiexec.exe
Token: SeBackupPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeShutdownPrivilege	5388	msiexec.exe
Token: SeDebugPrivilege	5388	msiexec.exe
Token: SeAuditPrivilege	5388	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5388	msiexec.exe
Token: SeChangeNotifyPrivilege	5388	msiexec.exe
Token: SeRemoteShutdownPrivilege	5388	msiexec.exe
Token: SeUndockPrivilege	5388	msiexec.exe
Token: SeSyncAgentPrivilege	5388	msiexec.exe
Token: SeEnableDelegationPrivilege	5388	msiexec.exe
Token: SeManageVolumePrivilege	5388	msiexec.exe
Token: SeImpersonatePrivilege	5388	msiexec.exe
Token: SeCreateGlobalPrivilege	5388	msiexec.exe
Token: SeCreateTokenPrivilege	5388	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5388	msiexec.exe
Token: SeLockMemoryPrivilege	5388	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5388	msiexec.exe
5388	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1956	TMmap.exe
1956	TMmap.exe
1956	TMmap.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 228	3432	msiexec.exe	81
PID 3432 wrote to memory of 228	3432	msiexec.exe	81
PID 3432 wrote to memory of 228	3432	msiexec.exe	81
PID 3432 wrote to memory of 4504	3432	msiexec.exe	85
PID 3432 wrote to memory of 4504	3432	msiexec.exe	85
PID 3432 wrote to memory of 4772	3432	msiexec.exe	87
PID 3432 wrote to memory of 4772	3432	msiexec.exe	87
PID 3432 wrote to memory of 4772	3432	msiexec.exe	87
PID 4772 wrote to memory of 4788	4772	MsiExec.exe	88
PID 4772 wrote to memory of 4788	4772	MsiExec.exe	88
PID 4772 wrote to memory of 4788	4772	MsiExec.exe	88
PID 3432 wrote to memory of 3088	3432	msiexec.exe	89
PID 3432 wrote to memory of 3088	3432	msiexec.exe	89
PID 3432 wrote to memory of 3088	3432	msiexec.exe	89
PID 3088 wrote to memory of 4412	3088	MsiExec.exe	90
PID 3088 wrote to memory of 4412	3088	MsiExec.exe	90
PID 3088 wrote to memory of 4412	3088	MsiExec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TMmap_x1.0.4.4_D24.48.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5388

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CE8446B75232A52FC2B10F964E30FBB5 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:228
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BCBE2BBEEBD7DFD7AAD9118E616B13C9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB1DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628281 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 92A2909C077E4C92923A2844D119741F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBA00.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240630281 42 WixSharp!WixSharp.ManagedProjectActions.WixSharp_AfterInstall_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4724

C:\Program Files (x86)\TMSoft\TMmap\TMmap.exe
"C:\Program Files (x86)\TMSoft\TMmap\TMmap.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b075.rbs

Filesize
250KB

MD5
9d14064ed4f3bb6904ce83cea15989b5

SHA1
34afe2156e368e593156d54d6f2acdcc5806f390

SHA256
8bc49be66a9ce3a53c7dbd93b8933da2e88cd59d7b2fae72fd91cdb0e35a01ab

SHA512
a376c7a94926b5656567c882c697160fcfc7492a506117e551c7b515323228f397e9f4df4fe3ff31fa3a3d337c5780e757eaf697903a866734bcbac2a7d59611

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\AppCopyUpdater.exe

Filesize
48KB

MD5
de099d6240da2cc70adf2625309939e5

SHA1
c4ed856d06a78a219426b02d06a46714ffe1a313

SHA256
400a09e923726adee5a860c7b71685bcbbee5e0a2f30f963a03dbd9a42c53d1d

SHA512
27672e3d4458fefe1c6df9dd0a4e3d9d2bcdc0dbc284f660ab1a8b862d600209263161515d23b1d2f4c5b62ba89cf962d94fdffcf0f139cffda1238dbe66e309

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\AppUpdateClient_V2.dll

Filesize
67KB

MD5
c7091ca6677c528ac23b9efc8d6266f5

SHA1
34a902cdce579630d8e8450f049da8d010e45ab5

SHA256
243ff59b11c4460bfc62f322e4b1d56498853a887d9dbb68e44c515900b01c15

SHA512
558c7990123543bef4145a2cb8ea8706c8bb0d8be833201798b3bc0db95b96f84a8ea48b1f0eea3bc042049a45a73f56b90f71496b2dc2a7972c9a875fd0d260

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\AppUpdateProviderContracts_V2.dll

Filesize
13KB

MD5
1890bce97558cf1dbac7cdd8fb3c795b

SHA1
9538f0a389e72a655011d82ef73192d62b917cd3

SHA256
e199c4ca8ca14b8448f724e7f2774bacdaa95462f4dba56d2b1bded8619d28ed

SHA512
ba29c10727470bdb8c39421c2a7a7a6fe410ab196c130c1016e24549d3cdc6bafe85471e39a4cc2f74ec506972c3b7c02c5333e5944b4e508902bf2f1bd281c2

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\CerImporter.exe

Filesize
17KB

MD5
82d73d97e10922effce86dd1e48f031a

SHA1
d3b6fe51e7928ad98bfcb9a55ce3b9a4305dbae6

SHA256
1f83da4902e93522c475f20b107113a2aa4ad53dcb8ab45c576c3635341ad72f

SHA512
27198b74e96f2717842925d1e595a247be9eefaba0d18df7ef2c3be78d6d5276ad09fa64f611c77cc3007c3a3d1531f1ce85f72568090150f4afce6091af4c2c

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\ClientLKProvider.dll

Filesize
18KB

MD5
1798bc39ae006ee5fc4675e45f85dda1

SHA1
076703ead852f86d6d5e49e18eca1f0c5234da44

SHA256
5931f7f79b35edd27824d08abe0e8568df922b1c6712b35f0ce1887f9a0b4bb1

SHA512
24f6a752e42bef8ea25bebd05033fceef310b2eb4f4bee5448633df42178ca0aae513abb404b4c16a167c16b3cb25616ee0fc626a1a497ea4d0d545f7205c523

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Common.Logging.Core.dll

Filesize
11KB

MD5
b3d8e3eda46308d7519a8e738ada8c5d

SHA1
27703d005d2da8858f2f1d5c41b43a05d71210dc

SHA256
8d6580c6e5a7f1e054052defbb28d6ffa87f6b2748d62f5ee37897b04509516f

SHA512
0f458c60d94ae5ad5bd4a7ebf79e5ad1ab0b86181381c81d543168a09f449fac025f6c7387ade0754f07371df02eb315732ea080b793b261c0e1cf7e306dd60a

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Common.Logging.dll

Filesize
45KB

MD5
f3902f07b84e371c8d46d673fcebd2c8

SHA1
30e30d230d3eb1de8a32fd4b16e09c8d5e2d4cd7

SHA256
ea504ec13616def40971b09e2617f26ede34b12349f4c14d7fda6182246eb645

SHA512
4e67485fb9b9fb01dc448a77e78caca49ebbe8be0ebbe7013873fce6dc9dd6b7d5aa3c0993e22c07c5fb47dac80ed7b0b68d257e19feaa9882a05623be5407c5

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\CompoundLineSymbolizer.dll

Filesize
12KB

MD5
d46c3f2d412ad2ac73642eccb898e415

SHA1
7dceb2c0df72d548b0021193e39fc2bc05aa6a2b

SHA256
ce787fef72df2231db7b248154b2fcf9eeb211442f5267de0f93039f7f02d8c8

SHA512
47077a71518db06da512d112f4a06800d3859b10d6e8a080767dc8fb5b30070e8bcf9aac872ccfd40c3da03c64a5cf64207664ac36ab72856dadbcb7d8aea8f7

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\MObj.db3

Filesize
1.2MB

MD5
c82e644cac063e4f8a0a4b5f0c1a44ef

SHA1
88e2a50c389e661b3cec491ce803187d85c15a90

SHA256
363276ff06fb77ec61252c1b691f6c94165cfc21beac1cd557f5c9b0d5de05d8

SHA512
bda80bd90409f32bf2f455a204a6c75b8b0578fe75e45b1f6667baf6d287874b044e14f788c7ed49d75c0b220fc33e4fe21bc3853d2eb2dceadf2cb1af8973b3

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Border.frs

Filesize
15.7MB

MD5
400e6381395a30360e31589f12933aef

SHA1
c8d0ed11af7842e42f4fa40721c0d05e5dbcadbe

SHA256
e9b7a189604d91ef5ccba6ebc08c09099776f391c0a3b10236e7b159110d20c7

SHA512
b139d3211b3f93f6424c945a9c907b06f7938525cc891631ce0830954a490a3201c871bdcaac285245adefe231beba4f64ffb02a97f5f5bdf02f0dae4c8cbf2c

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Color.dat

Filesize
2KB

MD5
64a69e8f8e845cc1e56876b8febd1dcf

SHA1
05674595133315b2b523de6945669f85866867f9

SHA256
e312f01d1fbb5351aa0edda307539d0d8be673d009e2da5aeab14eb5d2060611

SHA512
a31d3dcd4598b6d46500563efcd2083dc6eecb5458508c36fa1cd54e78fb729b5d5930db4f4cb75de193e4db02b089429abe7971145347a598c73560b09d583e

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Config.dat

Filesize
6KB

MD5
c1b2cbb07f572d34b03e969a3949d75e

SHA1
ef9e9e956a66e4a8372f69dbcfe1aa7453f5c13c

SHA256
d53092ad1ecd3ae01aec30edda8e28f586265251d67b10ce90471eea38994490

SHA512
46533f7259283c2fd97a74c87238bfd0f80ceaaf7fcf6cb447a729f75d59735c729d5a040dbeb865afc07876ae521818d35f4df7b050683e11021afbe74b306d

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\CountryNames.frs

Filesize
24KB

MD5
565441a261ec5b6c809841e46900abe3

SHA1
305e6e888fd26091ab87922a6c56f4d2add2d5f9

SHA256
e694b074be68b6a5104fb7040316b4d3c5d89a5512268fdb07086aa597638730

SHA512
f9acea4b883dfbef6921412ca9881bbb5681df2e9ca54c2f82d6c28151981d98d5f6f2a19fb636fe2146514fe71c9b4896c1bae0594b4295bed64b034d6742ff

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\GroupIcons.frs

Filesize
11KB

MD5
a585e3165598c7c477e20c58206e6c5d

SHA1
d9af6a8cfd5ead22abb98b719805b27a81993bd4

SHA256
ffeda9eabc0a706f1e0a55f390f1e8bad0069dc0c6263ecb3e359e039dcf50a8

SHA512
627635f3dd49c681adfdcd8b239c382ad3642b7a83613a3fc5a2db3d4a94bde00a31a0f3ddf58a4d9ab640e1edd1e95cd53ca7ca8571b43a825f92f4bb0a0aba

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\HighlightIcons.frs

Filesize
23KB

MD5
380d0b5be0e1034d356218b66785c5e4

SHA1
c76ea8e35e560886af27da5a9bb08e9dc2e90b16

SHA256
6ff6654caf22e07edee7de17d158cfa472c6783b79be286c74cd189ce44f5ae9

SHA512
41a8fc4de667aa3469c7e671dbb766a850c9ffb59164fe98c788f8ac35fac1182ceac5646a65d80cc416de33b409cc013fa7f0a43f7f3eb6dae5e2504f26941e

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\LayerIndex.dat

Filesize
477KB

MD5
3a238fa49aa611058236490a3007c3e3

SHA1
cfac88d2178aa104347d04192a24a9dc3e79c85f

SHA256
a5aefdade469a7cf50e10c20659360142e652e7a7fb26fb70a8aec5b607ba2e4

SHA512
218301b67f26dd64241de79be184d2a47abb94854b264da03db23c5a4c1a55c6ed4a1ca865db7ff2bfe9b47850805d847f2b6b62975fb08557fd5b79ceaac615

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Stations.frs

Filesize
7.6MB

MD5
420c889c843391e3475c171a005d63a3

SHA1
f2864e149a5db3bbcde10167b74d588333288115

SHA256
96b7a14221ae14808363e839a5d0a5842ffa10f5aeea232a4e26e3b048e220bf

SHA512
f74976ff1b66ad9b21403125e22cd46a1b059d341a493b26cecce3b102af8a4084cb16f0e4c95666be04feeedc8c445d3f91f29198349938ca3e797b19952c64

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Template.dat

Filesize
54KB

MD5
ffc6ceaeedd3a610051a54bc3fe73e7f

SHA1
a2261254f41fb979df5b0aa919aac556e247aa81

SHA256
56cb4bbe7d00e558aea271e3f7e5f21afbe5aa3ef1d07ab83cd4a8b28bdda0c0

SHA512
157a21910a6386f9c45a437c961c3521398b9572ce4b0dca12045a5db97ccf2c996927692a2e4dec7232a8de175869d25a77d8c7756e5ed3b9cd27069c7971a0

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMSharpMapControlData\Water.frs

Filesize
19.6MB

MD5
05df1211d0ad635df076c2786f753288

SHA1
d902d187d517e6085cbd9fef82fef9613aa3650c

SHA256
407c30b2fbec80558c754ba53263f384d48b7173af6bafd63cb5a3c93eca4935

SHA512
7100f4d5a273355c41d4b253cc6f66abd2cd1c695d1aea25761e99e9f695db241ad65a118eb9fbca6a28a247bddb359a21b4b6e6265e050abe570a1397689532

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMmap.db3

Filesize
29.3MB

MD5
339b226d1b3939b9b8f8c3ce3a592709

SHA1
399d1fe22c9710f8e2ba57993ea7685293b46ccc

SHA256
e2868baffc700290c662c42b1169a6eadbabba2d0c47bebf1e6a5a9197baf9b2

SHA512
99e59df3f9e2421aab02cf39f57dd816ace182147f60a789849c41cf725dda33810ac16b0993cbb18d25b276096d8063f1fff4c983b7af0e073a7539400898ef

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\TMmap.user.inst

Filesize
4.0MB

MD5
3af0bed04af12c88d080b15590de2978

SHA1
597a3a4221cee2d33a1206836c9378facfc5c744

SHA256
72e2fe48890a57149b6275766be503aa13ca348dba449a01ec9e434f727a6f3d

SHA512
1e1723eb1b99745f7f534389f4b1bfcd19c3bafd5af2c7af142f853546d9ed92dc1fad72079e7d4ea2b6bcc91bc52b958eb7fb2633e6ae1d60e87b979866c975

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Data\tmdoc.chm

Filesize
500KB

MD5
df9e50aaf5196d3834f18b96685479d5

SHA1
b348f952fa0d13a00cbfbab69ec198f0b84c6730

SHA256
fd03984ceab0aa6952e564c04c7a4e9a406774a6dae2d445d815277231b336b8

SHA512
73d5fc9fcd886eb775061a80ce3caaf20442c24a99b23f7d119550e47a9ed000e23c2b1853f42bf63125f8e6bc4c9c86cb71a03301b72693afd6a2276a34fbb0

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\DocumentFormat.OpenXml.dll

Filesize
5.5MB

MD5
ccb4e8921e806e66d4012a1f2f3ecf57

SHA1
65401be7a4061309c05d4b687247d3e20e61e10e

SHA256
82bf69ddbb686a80d9dedf90c6c7c4f41b89baf318f7cbdfcac92dcd768158d5

SHA512
797669d2012fa2b08a78ee7c0d4044e35a09667f9286caaaff48756d3767186ebe9edb9e510e92a844ff15b7cb1b1d6cdd76302ba3eeb7b63a57273ae4490d08

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\FileStorage.dll

Filesize
32KB

MD5
45a7af69ece13da5c32302e4c2dd8eb9

SHA1
95142e33b26272c56f5e2cbc50ef0fde390e862d

SHA256
651cce3158d700a8ab698e62521b3f26588c64ac7fd8785414d02e4aefee4237

SHA512
0dc47182143a3602d852cffb40b9115eb16b125168d4f1b810a40e37fa71c858e246db536bb06910d8f8ca54d989b23434cf06e38c17092c4f38bfb09d0137a7

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\GeoAPI.dll

Filesize
59KB

MD5
7142b8b9f9c0d68ccf06c937f798f17b

SHA1
3ed0c31a47f3b2e8e12b0db2059a4ea766ca4c62

SHA256
343d9e9fa7a545687ddefcbeffdd2e5ac703ad967f9195cb54414a54138dbf99

SHA512
225426b881ba3355c1be53edcd59bc97707564186344c344dc2ef147f8cd32ec8a694683e7aa0a35d2e573f7a6e2ea3090eada59bfc559b30623fc22d10fcafc

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\License_ru.pdf

Filesize
77KB

MD5
7e8671facaa475f2b93d811f635fc99c

SHA1
795389dad374e78f8ad6c1adc24b64b1a8aced3d

SHA256
01903b0d6856f86662804e8581e9150b5f23549e6481989ca483235349dfdd7c

SHA512
4a7d66b2ef7e91935b7b2a6132e785751e26d85a7d9a2db0acb0f8f197e9088002bc79ef42b4a90ec09b6a74b0841a6ae9ac76e1dd1303f31a1f9231d1c99c78

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\License_uk.pdf

Filesize
79KB

MD5
d06b47f1588a5ff3f3fafd2b7e4a544c

SHA1
5c992dfe6ebef36fbc75e8e74cad58148c117a63

SHA256
397dc0ed53a4d408581b617b43e0ace28511ee094f60600010a39794f3e80e1d

SHA512
185ec0b5e8a631fe4711dbf369280f4d967a8d2d470ae84d112215e353e74489ce673029aa501411e25bbafc18f7fb50783a0ae2598a6d5ba780423b1da5e684

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.Common.dll

Filesize
8.6MB

MD5
6e40c2d21e3a558d26aff781db8bfa68

SHA1
75d05ed6630bad2fad368f6d5de11a3c8ce9eacd

SHA256
992a9e2c94e9026adcdefee31520582f53abfa3c604ab37250733d0be8a023ff

SHA512
7daf0688a5b02b11e71b0832c11bfe84c7cd78b46cec9279730d661b85397fc05d8834ac5bae3365b3296019047c829505e3dfa1b20fb6313e4e09e9fc5f0762

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.DataVisualization.dll

Filesize
4.9MB

MD5
2dfdec895665090248fa590443cb2da3

SHA1
ebcbcf2991c6943043c9c4b3217b9b1fe7b9c261

SHA256
ebd10b1c2afc2f04e534230b4eb8f074d741f7a183763f23524102614fb5e718

SHA512
99969f019a95c84fb29c05c65ee01a2b5b1dde1427c710c233e3d05db66bd21343faf17293fc1a696753370eb4b63faa6d643617e69d0754bd88370cf071042d

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.ProcessingObjectModel.dll

Filesize
87KB

MD5
5ba2760ce829bfde0721259385178968

SHA1
eb72a2dcd5f1512bb358874fca6b9b95d5a21292

SHA256
10c0aece039d83e0cd4646cc873a7c847784bc9cae6fdddf24589c99d5d6a7e4

SHA512
b74afb6eea66ed015c0eae5d70b25ad0fe06cdb4dcd476f60e9ffb4d22e1d5ff9ee4963361c136a4a5ed82af0050f4def01d6307fdc045027be1b3dda7bb5fad

Download Submit
C:\Program Files (x86)\TMSoft\TMmap\Microsoft.ReportViewer.WinForms.dll

Filesize
576KB

MD5
787be96949cadb320c378ab562c01679

SHA1
0e3cf618b287f018e5f62e6923c5f4772ec992d4

SHA256
932315d69a0f1ff23fc0909c9e72e37ce847b6502b949741924a591917ed6719

SHA512
6f7641fdd5325b4ae13d8b9edcc1fdd1fc225852c319b557a76295652db1e96780f7ecf88f78b52826fa378d8b9579ef175220e7656a3b70faf1f8a0709e53ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
c4ce6fd8431b5747fd7a4c401325fb3a

SHA1
2f227bb73b2fae1020ca2b8b95b5b73b8f35403a

SHA256
3c801df6bf214e7b7b80514241c3f6d0d250ddbefd8c3dcffc7402c2e755f970

SHA512
379915b75023e787a13d55c35bc64f48b23dc59dda5ea65aeab4815aeb45b676f7364e7c42acc416cb8b1f9142c4af89c2a193913a3cc01672e6bf2c9d9bda26

Download Submit
C:\Users\Admin\AppData\Local\TMSoft\TMmap.exe_Url_s2ovqw2jf15no0ak4syygxwxrw2nqqzh\1.0.4.4\pbduhmhn.newcfg

Filesize
954B

MD5
918a7b5edf35ba9c124f7f5cd58d2c2e

SHA1
72f10a8e813ba1a762de4839467c33b6adfeb41e

SHA256
8ac867c5822e4cb006328b726baea5c4554c4b7e7478c7ec8639256d13b10cb6

SHA512
e1f087fae0c7477c69a25ad9b1046ddf393fbcb373baca5179bf412cf1268e1f331e1961c9710b9dd019d420fdd13febe23a10e850387ebc211341b3c7f8aaae

Download Submit
C:\Users\Admin\AppData\Local\TMSoft\TMmap.exe_Url_s2ovqw2jf15no0ak4syygxwxrw2nqqzh\1.0.4.4\user.config

Filesize
824B

MD5
0e832a43211d07e3d7d052ea9e589745

SHA1
8bcc8c8da31516612bec6942733c49bf57a85d45

SHA256
cb26b6c80de40af750cb99763e6a6e5abdea21d599eb58714b6ecce9fb5521e7

SHA512
b5770a50dc9b89c1be7c92bd67976c94b798f3ab25abc383fa4361a60680fd3ca2e70e20e9177addba1df016f19e38211fbc919b06e53f20a18b6fca0d134590

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI81F1.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Windows\Installer\MSIB1DB.tmp

Filesize
384KB

MD5
f41c90d6f89fbada25de1dfed3c79ce1

SHA1
13f6b1030c7fc8f7b5db6573ec3eeb60182b1aef

SHA256
f018289ee47bcd8b0c0efcef3bcc52e135dc25d265e75d86a5f93e303b0dd0bb

SHA512
9e30613f5e3af095a7a2556b05a703c856a95e05ab9b2b488280bc69f783aba690fb25e08890a8eb02519477cec23295c24dabf5e94ab537017174605da291dc

Download Submit
C:\Windows\Installer\MSIB1DB.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIB1DB.tmp-\WixSharp.dll

Filesize
397KB

MD5
5f398ecbd6af4df1b7446d3479af55ed

SHA1
6cf54984c3321479a34a962228a9091eb5a8b488

SHA256
7551baf65ac24dcebf775475577368e6f8ebf5eb74822ddd4966c15c0d110be7

SHA512
5ce8fd49c5e9af8f465c560d846a3d59f0d5eded9aa5cfebc8965047559ef62283d10ffe0918b8b2732b4fe47d0dd5e92cd389ac27a5759e342ff74d5a0fe6be

Download Submit
C:\Windows\Installer\MSIB567.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIB597.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\Installer\MSIB9B1.tmp

Filesize
224KB

MD5
4837bbfa20c65ac97910388f07d1785e

SHA1
e066a3d68c8a5c099633f22a32e22cb8c4f24d8c

SHA256
29b9f6167ea343f279c7ebafa18f8fba0fa8c3c21f9f33e7741452c856d45664

SHA512
91cade5a43fedce4c06e21cd68023ad13ecc18ddf34379544f8111569868980d3852e93d8f0ccbb013df317f9ee1ac97d9a16862878371ec2cb0fd51b3468037

Download Submit
C:\Windows\Installer\MSIBA00.tmp-\CustomAction.config

Filesize
980B

MD5
c9c40af1656f8531eaa647caceb1e436

SHA1
907837497508de13d5a7e60697fc9d050e327e19

SHA256
1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8

SHA512
0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7

Download Submit
C:\Windows\Installer\MSIBA00.tmp-\TMmapSetup_WixSharp.exe

Filesize
15KB

MD5
6970d1e7453196f1394d229f67ebd31f

SHA1
bde6b7039a2d08a16cb79f9b70c37a5ed746386d

SHA256
a7a78021a765ba4c7e7d2681fb87be13b14deb2c50c8158bed64723c0adb0b8a

SHA512
820a4f3a2422f77f6f8676adc86918a3da9e07c8649eb8416cc361b57ed6c7404b692d8e5fe2c968391e49f4460fda1ca6e0d6045eeaa957893cc8a4ce61b72d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
0d565b0d0c339ba6ff45ebcc87782ed9

SHA1
2039d6db5a13c82861af5413ebc7ab21e28a38db

SHA256
b63dbc1a803d16ac7cfc6bb1bf8e67c6d4b1dba0a0d8a197487f6f6df21ed0e3

SHA512
cd888ce68fb5ad6509e4fcd03a2c93358e0d5870d27260ba0d0fadf9fdad5f275cceda5379b43843f03ba838534cc1a748fe6032ce97b2638182c2e0b4563a27

Download Submit
\??\Volume{4eac8ed7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0ba4eeb0-dbd6-461b-8385-53f23b6f9bbc}_OnDiskSnapshotProp

Filesize
6KB

MD5
d295890861733decfa73fa75f8a8ae83

SHA1
797845ee7df8565b175f75aa4765320ecb406167

SHA256
bd41c273c57fbb4c5f6fcdcbe8604a3bc8af72e73d530c961383f6a63117c5af

SHA512
198f40e6483b13bf3d756dcdbf08d1169de6c38640f6f95c483e948cb90cc48d844d1954cb4a0cb86f7014289f2af3a288b27554b93e6ecb46d9912268439f65

Download Submit
memory/1956-249-0x0000015E6EF00000-0x0000015E6EF7E000-memory.dmp

Filesize
504KB

Download
memory/1956-245-0x0000015E6E7C0000-0x0000015E6E7FE000-memory.dmp

Filesize
248KB

Download
memory/1956-218-0x0000015E50A40000-0x0000015E50A56000-memory.dmp

Filesize
88KB

Download
memory/1956-219-0x0000015E50A30000-0x0000015E50A38000-memory.dmp

Filesize
32KB

Download
memory/1956-220-0x0000015E50AB0000-0x0000015E50ABA000-memory.dmp

Filesize
40KB

Download
memory/1956-221-0x0000015E6A190000-0x0000015E6A214000-memory.dmp

Filesize
528KB

Download
memory/1956-268-0x0000015E73620000-0x0000015E7372A000-memory.dmp

Filesize
1.0MB

Download
memory/1956-267-0x0000015E6C360000-0x0000015E6C36C000-memory.dmp

Filesize
48KB

Download
memory/1956-235-0x0000015E6A510000-0x0000015E6A51A000-memory.dmp

Filesize
40KB

Download
memory/1956-236-0x0000015E6BA50000-0x0000015E6BAAE000-memory.dmp

Filesize
376KB

Download
memory/1956-237-0x0000015E6B9F0000-0x0000015E6BA12000-memory.dmp

Filesize
136KB

Download
memory/1956-238-0x0000015E6BAB0000-0x0000015E6BB2E000-memory.dmp

Filesize
504KB

Download
memory/1956-239-0x0000015E6BF10000-0x0000015E6C2EA000-memory.dmp

Filesize
3.9MB

Download
memory/1956-240-0x0000015E6BBC0000-0x0000015E6BC02000-memory.dmp

Filesize
264KB

Download
memory/1956-241-0x0000015E6BC10000-0x0000015E6BC50000-memory.dmp

Filesize
256KB

Download
memory/1956-242-0x0000015E6BC50000-0x0000015E6BC8A000-memory.dmp

Filesize
232KB

Download
memory/1956-243-0x0000015E6BA20000-0x0000015E6BA46000-memory.dmp

Filesize
152KB

Download
memory/1956-208-0x0000015E4E850000-0x0000015E4EC40000-memory.dmp

Filesize
3.9MB

Download
memory/1956-246-0x0000015E6E880000-0x0000015E6E8F6000-memory.dmp

Filesize
472KB

Download
memory/1956-247-0x0000015E6C370000-0x0000015E6C38E000-memory.dmp

Filesize
120KB

Download
memory/1956-248-0x0000015E6BEF0000-0x0000015E6BF00000-memory.dmp

Filesize
64KB

Download
memory/1956-261-0x0000015E6C300000-0x0000015E6C30C000-memory.dmp

Filesize
48KB

Download
memory/1956-250-0x0000015E6E800000-0x0000015E6E83C000-memory.dmp

Filesize
240KB

Download
memory/1956-251-0x0000015E6F020000-0x0000015E6F0B2000-memory.dmp

Filesize
584KB

Download
memory/1956-252-0x0000015E6C3B0000-0x0000015E6C3C4000-memory.dmp

Filesize
80KB

Download
memory/1956-253-0x0000015E6E840000-0x0000015E6E860000-memory.dmp

Filesize
128KB

Download
memory/1956-254-0x0000015E6C390000-0x0000015E6C39A000-memory.dmp

Filesize
40KB

Download
memory/1956-255-0x0000015E6EF80000-0x0000015E6EF92000-memory.dmp

Filesize
72KB

Download
memory/1956-256-0x0000015E6BF00000-0x0000015E6BF08000-memory.dmp

Filesize
32KB

Download
memory/1956-257-0x0000015E6C3A0000-0x0000015E6C3AE000-memory.dmp

Filesize
56KB

Download
memory/1956-258-0x0000015E6EFA0000-0x0000015E6EFB2000-memory.dmp

Filesize
72KB

Download
memory/1956-259-0x0000015E6F0C0000-0x0000015E6F0FC000-memory.dmp

Filesize
240KB

Download
memory/1956-260-0x0000015E6F000000-0x0000015E6F012000-memory.dmp

Filesize
72KB

Download
memory/4412-145-0x0000000002E80000-0x0000000002E8A000-memory.dmp

Filesize
40KB

Download
memory/4788-35-0x0000000005250000-0x00000000052BA000-memory.dmp

Filesize
424KB

Download
memory/4788-31-0x00000000051B0000-0x00000000051DE000-memory.dmp

Filesize
184KB

Download