3d043a07cb9f62ba747e9080e4ee9d7867b97e5bdc20a70a60d2ee0b8b44c8ae

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Logicum_1.0.35_x64_en-US.msi
Size 12.6MB
Sample261102-2rrpfaxthy
SHA256 3d043a07cb9f62ba747e9080e4ee9d7867b97e5bdc20a70a60d2ee0b8b44c8ae
MD5 dba643f755a63329f486db18975acf00
SHA1 6f2e7dd8ee7b76d55738b26610a54d1a89626b40
SHA512 30707e3492cdb6dc4a4987a24558bb51e8607f20b3962b7f1f388ccdc82a897a2634ade2548af07aaf27b0570575afc1884f652049507d7ba30fc0ee0d557633
SSDEEP 196608:kdwxsBSnsvYyAYyZ3qzzIxiuhNqOqG2kVEmiAgOGk4wS+R+48+oxfahbYAnDTxzL:kbSoEqzEAumb4qk0Fy8faC2DTxJUwf
TLSH
T1F8D633DB3C82D626C8291CB96476C3A0897DAC844A51D40333AAB35DE6F25E44D7DFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2672	logicum-desktop.exe

Loads dropped DLL 1 IoCs

pid	Process
2544	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	logicum-desktop.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Logicum\logicum-desktop.exe	msiexec.exe
File created	C:\Program Files\Logicum\Uninstall Logicum.lnk	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59ea18.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ea18.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC96FDF24BF38D43C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEEA.tmp	msiexec.exe
File created	C:\Windows\Installer\{D972DD54-E7BE-439C-BADD-7E94EBB4DC36}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB25B711E5BEDAC56.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D972DD54-E7BE-439C-BADD-7E94EBB4DC36}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCF3C343F19C9B889.TMP	msiexec.exe
File created	C:\Windows\Installer\e59ea1a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3404_990712384\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3404_990712384\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{D972DD54-E7BE-439C-BADD-7E94EBB4DC36}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF438365F09DA194F7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3404_990712384\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5200	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	logicum-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	logicum-desktop.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	logicum-desktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	logicum-desktop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0d977edac71670e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b0d977ed0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b0d977ed000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b0d977ed00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b0d977ed00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.pdf\shell\open\command\command = 510076004e0074006e00590045002c006700390024004f006700660057002c0064006a005e003500530068006f0072007400630075007400730046006500610074007500720065003e004d003f00610030002b00240026004b007b00440075004a004a003100570053004f00330024005a002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\ = "Logicum.jpg"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpeg\shell\open	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.txt\shell\open\command\command = 510076004e0074006e00590045002c006700390024004f006700660057002c0064006a005e003500530068006f0072007400630075007400730046006500610074007500720065003e004d003f00610030002b00240026004b007b00440075004a004a003100570053004f00330024005a002000220025003100220000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.md\shell\open\command\command = 510076004e0074006e00590045002c006700390024004f006700660057002c0064006a005e003500530068006f0072007400630075007400730046006500610074007500720065003e004d003f00610030002b00240026004b007b00440075004a004a003100570053004f00330024005a002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.md\Logicum.md\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.md	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\45DD279DEB7EC934ABDDE749BE4BCD63	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpg\shell\open\command\command = 510076004e0074006e00590045002c006700390024004f006700660057002c0064006a005e003500530068006f0072007400630075007400730046006500610074007500720065003e004d003f00610030002b00240026004b007b00440075004a004a003100570053004f00330024005a002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.png\Logicum.png	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.pdf\shell\open\command\ = "\"C:\\Program Files\\Logicum\\logicum-desktop.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Logicum.pdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.png	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.png\shell\open\command\ = "\"C:\\Program Files\\Logicum\\logicum-desktop.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpeg\shell\open\command\ = "\"C:\\Program Files\\Logicum\\logicum-desktop.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.webp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.txt\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.webp\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.txt\shell\open\command\ = "\"C:\\Program Files\\Logicum\\logicum-desktop.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\Logicum.txt\ShellNew	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "Logicum.txt"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.md	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.png\ = "Apri in Logicum"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\45DD279DEB7EC934ABDDE749BE4BCD63\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\PackageCode = "64DA4985605D348499F5209E72D5E5D9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\45DD279DEB7EC934ABDDE749BE4BCD63\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\ProductName = "Logicum"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\83618D78B2ADDE55A9B13D211CE904D0\45DD279DEB7EC934ABDDE749BE4BCD63	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.pdf\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.png\shell\open\ = "Open with Logicum"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpeg\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpeg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.webp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.txt\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.txt\shell\open\ = "Open with Logicum"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.md\ = "Logicum.md"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpg\shell\open\command\ = "\"C:\\Program Files\\Logicum\\logicum-desktop.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.png\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.png\Logicum.png\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.png	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\Logicum.jpeg\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.webp\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Logicum.pdf\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpg\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\Logicum.jpg\ShellNew	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.webp\shell\open\command\command = 510076004e0074006e00590045002c006700390024004f006700660057002c0064006a005e003500530068006f0072007400630075007400730046006500610074007500720065003e004d003f00610030002b00240026004b007b00440075004a004a003100570053004f00330024005a002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.txt	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.jpg\ = "Apri in Logicum"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\45DD279DEB7EC934ABDDE749BE4BCD63\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\45DD279DEB7EC934ABDDE749BE4BCD63\ProductIcon = "C:\\Windows\\Installer\\{D972DD54-E7BE-439C-BADD-7E94EBB4DC36}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\Logicum.jpg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.md\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.md\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.md\shell\open\command\ = "\"C:\\Program Files\\Logicum\\logicum-desktop.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Logicum.md\shell\open\ = "Open with Logicum"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	logicum-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	logicum-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df06b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	logicum-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c0000000100000004000000800100006b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	logicum-desktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	logicum-desktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	logicum-desktop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	msiexec.exe
4128	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3404	msedgewebview2.exe
3404	msedgewebview2.exe
3404	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5200	msiexec.exe
Token: SeSecurityPrivilege	4128	msiexec.exe
Token: SeCreateTokenPrivilege	5200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5200	msiexec.exe
Token: SeLockMemoryPrivilege	5200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5200	msiexec.exe
Token: SeMachineAccountPrivilege	5200	msiexec.exe
Token: SeTcbPrivilege	5200	msiexec.exe
Token: SeSecurityPrivilege	5200	msiexec.exe
Token: SeTakeOwnershipPrivilege	5200	msiexec.exe
Token: SeLoadDriverPrivilege	5200	msiexec.exe
Token: SeSystemProfilePrivilege	5200	msiexec.exe
Token: SeSystemtimePrivilege	5200	msiexec.exe
Token: SeProfSingleProcessPrivilege	5200	msiexec.exe
Token: SeIncBasePriorityPrivilege	5200	msiexec.exe
Token: SeCreatePagefilePrivilege	5200	msiexec.exe
Token: SeCreatePermanentPrivilege	5200	msiexec.exe
Token: SeBackupPrivilege	5200	msiexec.exe
Token: SeRestorePrivilege	5200	msiexec.exe
Token: SeShutdownPrivilege	5200	msiexec.exe
Token: SeDebugPrivilege	5200	msiexec.exe
Token: SeAuditPrivilege	5200	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5200	msiexec.exe
Token: SeChangeNotifyPrivilege	5200	msiexec.exe
Token: SeRemoteShutdownPrivilege	5200	msiexec.exe
Token: SeUndockPrivilege	5200	msiexec.exe
Token: SeSyncAgentPrivilege	5200	msiexec.exe
Token: SeEnableDelegationPrivilege	5200	msiexec.exe
Token: SeManageVolumePrivilege	5200	msiexec.exe
Token: SeImpersonatePrivilege	5200	msiexec.exe
Token: SeCreateGlobalPrivilege	5200	msiexec.exe
Token: SeCreateTokenPrivilege	5200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5200	msiexec.exe
Token: SeLockMemoryPrivilege	5200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5200	msiexec.exe
Token: SeMachineAccountPrivilege	5200	msiexec.exe
Token: SeTcbPrivilege	5200	msiexec.exe
Token: SeSecurityPrivilege	5200	msiexec.exe
Token: SeTakeOwnershipPrivilege	5200	msiexec.exe
Token: SeLoadDriverPrivilege	5200	msiexec.exe
Token: SeSystemProfilePrivilege	5200	msiexec.exe
Token: SeSystemtimePrivilege	5200	msiexec.exe
Token: SeProfSingleProcessPrivilege	5200	msiexec.exe
Token: SeIncBasePriorityPrivilege	5200	msiexec.exe
Token: SeCreatePagefilePrivilege	5200	msiexec.exe
Token: SeCreatePermanentPrivilege	5200	msiexec.exe
Token: SeBackupPrivilege	5200	msiexec.exe
Token: SeRestorePrivilege	5200	msiexec.exe
Token: SeShutdownPrivilege	5200	msiexec.exe
Token: SeDebugPrivilege	5200	msiexec.exe
Token: SeAuditPrivilege	5200	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5200	msiexec.exe
Token: SeChangeNotifyPrivilege	5200	msiexec.exe
Token: SeRemoteShutdownPrivilege	5200	msiexec.exe
Token: SeUndockPrivilege	5200	msiexec.exe
Token: SeSyncAgentPrivilege	5200	msiexec.exe
Token: SeEnableDelegationPrivilege	5200	msiexec.exe
Token: SeManageVolumePrivilege	5200	msiexec.exe
Token: SeImpersonatePrivilege	5200	msiexec.exe
Token: SeCreateGlobalPrivilege	5200	msiexec.exe
Token: SeCreateTokenPrivilege	5200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5200	msiexec.exe
Token: SeLockMemoryPrivilege	5200	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5200	msiexec.exe
5200	msiexec.exe
2672	logicum-desktop.exe
2672	logicum-desktop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2672	logicum-desktop.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5200	msiexec.exe
4128	msiexec.exe
2544	MsiExec.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2544	4128	msiexec.exe	92
PID 4128 wrote to memory of 1816	4128	msiexec.exe	98
PID 5200 wrote to memory of 2672	5200	msiexec.exe	101
PID 2672 wrote to memory of 3404	2672	logicum-desktop.exe	102
PID 3404 wrote to memory of 4564	3404	msedgewebview2.exe	103
PID 3404 wrote to memory of 3636	3404	msedgewebview2.exe	104
PID 3404 wrote to memory of 3636	3404	msedgewebview2.exe	104
PID 3404 wrote to memory of 3636	3404	msedgewebview2.exe	104
PID 3404 wrote to memory of 3636	3404	msedgewebview2.exe	104
PID 3404 wrote to memory of 1888	3404	msedgewebview2.exe	105
PID 3404 wrote to memory of 5388	3404	msedgewebview2.exe	106
PID 3404 wrote to memory of 5388	3404	msedgewebview2.exe	106
PID 3404 wrote to memory of 5388	3404	msedgewebview2.exe	106
PID 3404 wrote to memory of 1304	3404	msedgewebview2.exe	107
PID 3404 wrote to memory of 1304	3404	msedgewebview2.exe	107
PID 3404 wrote to memory of 1304	3404	msedgewebview2.exe	107
PID 3404 wrote to memory of 1304	3404	msedgewebview2.exe	107
PID 3404 wrote to memory of 1304	3404	msedgewebview2.exe	107
PID 3404 wrote to memory of 4976	3404	msedgewebview2.exe	108
PID 3404 wrote to memory of 4976	3404	msedgewebview2.exe	108
PID 3404 wrote to memory of 4976	3404	msedgewebview2.exe	108
PID 3404 wrote to memory of 4976	3404	msedgewebview2.exe	108
PID 3404 wrote to memory of 4976	3404	msedgewebview2.exe	108
PID 3404 wrote to memory of 3952	3404	msedgewebview2.exe	109
PID 3404 wrote to memory of 3952	3404	msedgewebview2.exe	109
PID 3404 wrote to memory of 3952	3404	msedgewebview2.exe	109
PID 3404 wrote to memory of 5972	3404	msedgewebview2.exe	110
PID 3404 wrote to memory of 5972	3404	msedgewebview2.exe	110
PID 3404 wrote to memory of 5972	3404	msedgewebview2.exe	110
PID 3404 wrote to memory of 5972	3404	msedgewebview2.exe	110
PID 3404 wrote to memory of 5972	3404	msedgewebview2.exe	110
PID 3404 wrote to memory of 1936	3404	msedgewebview2.exe	113
PID 3404 wrote to memory of 1936	3404	msedgewebview2.exe	113
PID 3404 wrote to memory of 1936	3404	msedgewebview2.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Logicum_1.0.35_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Program Files\Logicum\logicum-desktop.exe
  "C:\Program Files\Logicum\logicum-desktop.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2672.5904.1175510590031824739 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView /prefetch:4 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffac5355fd8,0x7ffac5355fe4,0x7ffac5355ff0
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1812 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3248 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1 /prefetch:1
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3732 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4708 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4904 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1 /prefetch:1
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView" --webview-exe-name=logicum-desktop.exe --webview-exe-version=1.0.35 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=1816,i,3178501870574546325,2178203886226398127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2aa116a36e050202fab13b5d0b95749e50e823e1
      4⤵
      PID:1936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7916DDAE80065C7061072D9CCB3BCF7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2544
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ea19.rbs

Path C:\Config.Msi\e59ea19.rbs
Size 28KB
SHA256 d361c305ee55d4009bcadcfdb6ca22ba23aa997a3a3a8c4326c66a520d8b716f
MD5 64707a02afcc1fb0a10ee8b6fc69978b
SHA1 b369f5196396dd94a2511d288be82e9993a9044b
SHA512 c1a301f12c40e06dbe1fb194a548050327dc880549056f6864a2b310d1841fc5ad6028895cd5cfd46747982aa8816967e39f65c2ef128895d13802bc6a301e39
SSDEEP 384:wWL+r+U+k+O+q8qs/UyMSeASJCwMSzCwMVqFq:wJaZJjR9/UyMS1G/A
TLSH
T191D28146BA40E652D8E71F70C55B1B563B72D3D983A2474B418CC2348EC37962EAFE8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicum-desktop.exe

Path C:\Program Files\Logicum\logicum-desktop.exe
Size 22.4MB
SHA256 b4ddaaec7020c7c26b2d045b1dff0cd627500d0e0d288c2049fbbb70e5ee68a7
MD5 eb31d4b488da361cb1f33e7704da9a8e
SHA1 af0abc88f0e49815f93071dd79d910c8d73ba4f0
SHA512 62026598f5b164bd8a718e69678d9825f9663e9fc9585338ec826abcd71e9b9b1d12157924dd7a02c88d6ca91122fb6e5d55d28dfba20d6fb1e64b8e5ec32c90
SSDEEP 393216:jJB8a53YW4qMJQfzCwih8zQtiSZNq4DHk:jJB8apMqFD08T4DH
TLSH
T1D2375B147A5B9968D08BC4B0834B8A760A3130DF1B35B9BF44D496383F7EBF56F28259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logicum.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logicum\Logicum.lnk
Size 1KB
SHA256 1ae62fe38dfb3386e2cc54be15f4674e2de5a7e6453ab037898227ca431d4af7
MD5 9f6ac4ef22ecf137884d5d29e149bba2
SHA1 15bcc4722ee13a3668c9b03ffc060d3307c0262c
SHA512 1c68fe579b064db7ea975317769839550cee244fab17241ec44d34439e328254ddb14b1fd53cd8d336b48601bee74e9eeddb3a668a2c889c156d14e9e5622726
TLSH
T1D941AD112ABD1B3FE3B242395F7256348A36F912A9294F2B4185018649A4D40AEA8F6F
MD5 SHA1 SHA512 TLSH

Submit Download

~ogicum.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logicum\~ogicum.tmp
Size 2KB
SHA256 5c30b4d5e4451b1b37a1e155cd4bab0ad24edf330df60236623c1ca1a5010d6a
MD5 1cc6401bf177d9efbad2a58d57e77786
SHA1 eef12c81d968618185438bc8343bae8c815a0ed8
SHA512 a79cdd64774e29f51e330ada68666f2b3871813403ea6ffda501e2fafcf6aab029f3e68d6246efc560d139ca0423d43517ed9f92a42aaef2a1e230ebb8b9ce7d
TLSH
T1C441E3113ABE1B3FF3B302395F7259358A36F912B5284F2B4185018749A4D40AEB8F6F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI94C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI94C4.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1523c15d-f339-4a5d-9fad-9eb816850479.tmp

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\1523c15d-f339-4a5d-9fad-9eb816850479.tmp
Size 3KB
SHA256 c2e6c31bf1c49458453a63af5c17d16743b3878eccce296701489c502474027c
MD5 4ac2cd54d40dc7e07a7f068b1f104dea
SHA1 84caaae946cc3724f94084c7a6a7ae7c1d2cbc45
SHA512 79d0cabf1e3336b3e769355630ea295db38bae2b9e9f2f2553a4d204e56a47e021fe925f1b3ca1c9e22c2425b33f0e3801c84323519210e9a89dae0e98e3197f
TLSH
T1FC6175776974AA3B4EF38B14B9462B1EEBA54023E5817F65D9EC0F1D01D72981381C27
MD5 SHA1 SHA512 TLSH

Submit Download

34f26136-c723-4cf9-81af-9fc948339fe1.tmp

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\34f26136-c723-4cf9-81af-9fc948339fe1.tmp
Size 15KB
SHA256 a91f11632ab9fa9bde0c304ec5aa099d01dbd82496918e2be6eb4b1e3708c92d
MD5 5076474c12f027a95a5106f493d62a7a
SHA1 186f7e98ecfab80ecdeb4d7996b00651067b06cc
SHA512 d0be802d67726b06f7e421ae2464c6f405ddff38669daed98c3e11dd4c4d2deb6670c3d934ce68a27e19927f5a9cc777c6cbc83347cb451bd0951e11a949af7d
SSDEEP 384:Y+OBqImmJvGBLx3NaFMJFNNBSPeXJB/2Hg6rJ:BcvGtlNV5MVd
TLSH
T1FC72AEB628796E373CF78609BA8A238BCB655263C0C17BD9DDEC9F0F016E4841391D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

473b07d5-d782-441f-97d9-2682965f68ad.tmp

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\473b07d5-d782-441f-97d9-2682965f68ad.tmp
Size 2KB
SHA256 ba3769fbc57b8d1596a304b153fad8c983cc33b1c4348f0988c67be28ea9818e
MD5 afc9446ae26fcf0bef4d39eaaa82da3e
SHA1 e9d1a671daf09fbbfd6d9b99182c4ef03bbb45e7
SHA512 c56ea8b6bbbba00d009323614279f5d744437ce8ebe862bd83019175988f7ec9fccc696abe91af93fee82a54e5137cc778481ebafdf2df0d20eac3cf4b0d3a4c
TLSH
T10851A7737814A73B9EF247147A163F6BCE7980629A422F119DDD0B1D00D755D1381C3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ae3a2df7852a5aeaffdda24d57a21fcaeb2cb6dd348ade3dbbbf471212003bee
MD5 6bfec3f7882369126eb8d1645d373023
SHA1 211945d11129fea8fbf3595347fac7a703183d0d
SHA512 dce5e6deaefd4ffa7c29e8bc2103d4eef40ce1c5fb51aa72d842bdca046c9544a701972ccc1824b87b1bc1ba8e085693ca3e491fc41b0db34cdbebcc5c74750c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b07c1f89e96a58b2b3a08f3390e9789ce8df30a7ac4c73acd41436403f8d9a5a
MD5 e014c27c23e8c33bde7be9af49f938e3
SHA1 3e254bc8432613d1d7f078abbc44cc47f9988141
SHA512 27286919cd66bb6f703e75f4a0bb9784167df77005195286dd3501763e6fdf3a95c666429273d5a312bcdd92a2ef36ee7ca378fa1e7202e6692a6c5b0c3a22bf
TLSH
T1D0D0241333154174C41031331043714D0500D11F400DC005543CC51F5F44C540D03443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 559d8ce7a7b56af4bec7deada6ff6c06371bd5256d09ca2d47c8f6cd6917f94e
MD5 abadb802a38734ae07ec03a5dde6dae5
SHA1 ea7b222fed60dea7a70046264d626c9efbdd27f9
SHA512 8104ae9434fc4cd98c95053b45dd99db94b740719264b88c45a06fea070d364a096356169b42cf14c6b565613ba65f780081997d4a79048feaefb4f9f2be5c02
TLSH
T10A51507052C208BEFFF619B450D55F4672F6D464B2B30F974039A1B0B5677E980D18DA
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 3bb7ee3b2b7851cc1ab095bc5d058af6e64e39dd700045992e4d15f2a3628aaa
MD5 e76534561f5d0dbefd4140ecfc677257
SHA1 e527618b2e7ae8eb75671895e50920e89c9c5143
SHA512 3b8737d560bab8a4253bc88354fe9efb7308fe9faf70e7d60181b7595b19024466ad911e2aafced2ee168ccd19211832eeb1630d3799f00581deedbaa6cfcd51
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

803e11d3-9565-4a37-81b9-a81e46310cf6.tmp

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Network\803e11d3-9565-4a37-81b9-a81e46310cf6.tmp
Size 2KB
SHA256 962384d56ffb1f0f0c5e7918b8b682e16a863ca45929b42bea4f8c65b2c3d1da
MD5 054bc75cf6b9d6706d12d4e673f19207
SHA1 b5a6f7a517bc0cbd2bfb5acabbff058978f102b2
SHA512 d6dadf373949e12343feaaa3c5ba3969d102bf5d177798a1237283cf8065baf31fa218957a97fd52a59f8729db907f8adb5e59f0e8847e3bfd11e282fbad71ea
TLSH
T1E75190E6C2E8C67D89116AF427343D1BCD2D0A1992283D27CDDBEBDA67E1471D21114F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a5fb58d7-a508-4ef4-a759-b1dd2a2f036c.tmp

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Default\a5fb58d7-a508-4ef4-a759-b1dd2a2f036c.tmp
Size 6KB
SHA256 b72a62c9fb691c4d2c1ac782ebe2a6957dbb6a05109f8601af94ed08092e7849
MD5 7946eb921a5d713277a1a705a78c160f
SHA1 63c030aab6fed52791056a1666f6f982d0d64420
SHA512 9cf7a2e2f3b5e56cf22c4f64023e442ef1278903ffdac5549bddc46a417a6bf4cb66c8687fb66136c25584c8ed1cee5ccea3d3e29f955f9824bf120c030f2833
SSDEEP 96:stdM/dGIkythxb9U8kHbbo5h16Z0drs7/x+6MhmuecJd/RgMkkodldrewWK+gSMd:stmgl8eon9sV+FdB2worJXFqG6K
TLSH
T18ED1B8526E24797B4CC6E619BA35BB5FE2F9543164D11E58EBFC852C04DBACC2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.promethic.logicum\EBWebView\Local State
Size 1KB
SHA256 a52e64df3e308ef8579fe8f4cb379ac96b7e3c33fd8d23cc175abf8cec27a82d
MD5 62a36adb0d4faee4395db05ec9cb05f2
SHA1 237135d115052db67be403c2c01c329d6bface92
SHA512 3ac56f39669fbc1e064559a21ca6c873b2819753910fbe6f320491b4b0c702026be4d757320aaee92f5a0b3a90c3eb781632b0a5c4a81d4f6e8c3db705b67840
TLSH
T12521B7B2F4A85B37AD9603653222BA6F8F31407781019F0464CE4B1E02E608D9796C37
MD5 SHA1 SHA512 TLSH

Submit Download

e59ea18.msi

Path C:\Windows\Installer\e59ea18.msi
Size 12.6MB
SHA256 3d043a07cb9f62ba747e9080e4ee9d7867b97e5bdc20a70a60d2ee0b8b44c8ae
MD5 dba643f755a63329f486db18975acf00
SHA1 6f2e7dd8ee7b76d55738b26610a54d1a89626b40
SHA512 30707e3492cdb6dc4a4987a24558bb51e8607f20b3962b7f1f388ccdc82a897a2634ade2548af07aaf27b0570575afc1884f652049507d7ba30fc0ee0d557633
SSDEEP 196608:kdwxsBSnsvYyAYyZ3qzzIxiuhNqOqG2kVEmiAgOGk4wS+R+48+oxfahbYAnDTxzL:kbSoEqzEAumb4qk0Fy8faC2DTxJUwf
TLSH
T1F8D633DB3C82D626C8291CB96476C3A0897DAC844A51D40333AAB35DE6F25E44D7DFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3404_990712384\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 171c767400e980c1e5e547f49f1da8f1a989774aa82978f5e601278e49c75b56
MD5 d09780ac8f4eb76582960398b05c555d
SHA1 7098471e14f92f80ad1930e62f74b9c4ce123600
SHA512 bfc16142c674dc2edf040b374dec66ab7d295944e2f72cc97e280b8a605cd5e92b754755c2eba54f7ffd65d5a57f790fefd062f5d4feef00591254b1d5c0944f
SSDEEP 24576:xFo3DMP9doO/vvTL/yg00C1Q/Le+/7zHEpiW9p6ciBa6ZzFk8YRWk9O1g+e:BH4
TLSH
T1D057B42536F92210E7F79F3CA8F06A2749397D5B9C19DE8D05411B8E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4f1736e7-b430-4b63-98ee-2cefae69dee4}_OnDiskSnapshotProp

Path \??\Volume{ed77d9b0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4f1736e7-b430-4b63-98ee-2cefae69dee4}_OnDiskSnapshotProp
Size 6KB
SHA256 d8f45573cb941754ee3445dc0d2b6279f4a1c2e67e096a8c383077e3bac4b857
MD5 bae9e32dbdbd280f291b3339289d25c3
SHA1 90cb34ff58cdac64d6ad413a0fdd612a4d36a8b0
SHA512 1422ff330836f43da3a9fdc80cdcc10f7dcd3bc1f7b9859cbd8360d753fc4e04b47e62c44d973c7f68b980ad5160aa13be50532edf06a5fc613edc376bbf395d
SSDEEP 96:FYfYzRxvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:uA3b++uVm
TLSH
T1E8D189185AF54711E2B3AB3128F18557A877B911FF33CB8E0198238E6630A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-387-0x000001F185EE0000-0x000001F185F87000-memory.dmp

Download

memory/1304-78-0x00007FFAE8A30000-0x00007FFAE8A31000-memory.dmp

Download

memory/1936-468-0x00007FFAE95A0000-0x00007FFAE95A1000-memory.dmp

Download

memory/1936-469-0x00007FFAE7670000-0x00007FFAE7671000-memory.dmp

Download

memory/3636-386-0x000001CC88800000-0x000001CC888A7000-memory.dmp

Download

memory/3636-73-0x00007FFAE8A30000-0x00007FFAE8A31000-memory.dmp

Download

memory/4976-394-0x0000020922B60000-0x0000020922C07000-memory.dmp

Download

memory/5972-398-0x0000025CAED90000-0x0000025CAEE37000-memory.dmp

Download