URL:

https://support.logi.com/hc/en-us/articles/360024844213--Downloads-Spotlight-Presentation-Remote

Full analysis: https://app.any.run/tasks/a83c51c6-650d-499c-a67b-076845aa3b44
Verdict: Malicious activity
Analysis date: May 07, 2024, 16:47:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5C75EDF69369D3552EB1E76AC83D79AB

SHA1:

577B3CD4237DF0D91F9D3AD56E95988DE6FF9F3B

SHA256:

C5947BB3BC0ADC725EDB70883D93FBF1F8A2326C728ED26B62A559DC6EA8B905

SSDEEP:

3:N8dCBLJXBb8IWKMVFSPI3EEgIZv41DuiRA3tKm:2wBLJBbSKNwdNRSaB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)

    • Changes the autorun value in the registry

      • Setup.exe (PID: 3052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3052)
      • Setup.exe (PID: 3080)
      • PDSetup.exe (PID: 3112)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3052)
      • Setup.exe (PID: 3080)
      • PDSetup.exe (PID: 3112)

    • The process creates files with name similar to system file names

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)

    • Reads the Internet Settings

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads security settings of Internet Explorer

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUI.exe (PID: 1800)

    • Checks Windows Trust Settings

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads settings of System Certificates

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads Internet Explorer settings

      • LogiPresentationInstaller.exe (PID: 2772)

    • Process drops legitimate windows executable

      • PDSetup.exe (PID: 3112)

    • The process drops C-runtime libraries

      • PDSetup.exe (PID: 3112)

    • Creates a software uninstall entry

      • Setup.exe (PID: 3052)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2268)
      • PDSetup.exe (PID: 3112)
      • LogiPresentation.exe (PID: 3264)
      • LogiPresentation.exe (PID: 3496)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2268)
      • LogiPresentation_1.60.33.exe (PID: 2992)
      • LogiPresentationInstaller.exe (PID: 2772)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • RunNE.exe (PID: 3140)
      • PDSetup.exe (PID: 3112)
      • RunNE.exe (PID: 3284)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3576)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUI.exe (PID: 1800)
      • LogiPresentationUpdater.exe (PID: 1792)
      • LogiPresentationMgr.exe (PID: 588)
      • LogiPresentationMgr.exe (PID: 1012)

    • The process uses the downloaded file

      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 2708)

    • Reads the computer name

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentation_1.60.33.exe (PID: 2992)
      • wmpnscfg.exe (PID: 2268)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUpdater.exe (PID: 1792)
      • LogiPresentationUI.exe (PID: 1800)

    • Create files in a temporary directory

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • LogiPresentationInstaller.exe (PID: 2772)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 3848)
      • chrome.exe (PID: 2840)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 3848)
      • chrome.exe (PID: 2840)

    • Application launched itself

      • chrome.exe (PID: 3988)

    • Reads the machine GUID from the registry

      • LogiPresentationInstaller.exe (PID: 2772)
      • Setup.exe (PID: 3052)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads the software policy settings

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Process checks computer location settings

      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Creates files in the program directory

      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)

    • Reads Environment values

      • Setup.exe (PID: 3052)

    • Creates files or folders in the user directory

      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)
      • LogiPresentationMgr.exe (PID: 3800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
44
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs logipresentation_1.60.33.exe no specs logipresentation_1.60.33.exe logipresentationinstaller.exe setup.exe setup.exe runne.exe no specs pdsetup.exe runne.exe no specs logipresentation.exe no specs logipresentation.exe logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationonboarding.exe logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationui.exe logipresentationupdater.exe logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationmgr.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
112"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1516 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2012 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3128 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
552"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2024 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
588"C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe" C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe—LogiPresentationUI.exe
User:
admin
Company:
Logitech, Inc.
Integrity Level:
MEDIUM
Description:
Logi Presentation Manager.exe (UNICODE)
Exit code:
0
Version:
1.60.33
Modules
Images
c:\programdata\logishrd\logipresentation\software\1.60.33\logipresentationmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
748"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1292 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
920"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3828 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1012"C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe" C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe—LogiPresentationUI.exe
User:
admin
Company:
Logitech, Inc.
Integrity Level:
MEDIUM
Description:
Logi Presentation Manager.exe (UNICODE)
Exit code:
0
Version:
1.60.33
Modules
Images
c:\programdata\logishrd\logipresentation\software\1.60.33\logipresentationmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=872 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1244"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3368 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
33 993
Read events
33 740
Write events
243
Delete events
10

Modification events

(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
141
Suspicious files
63
Text files
78
Unknown types
217

Dropped files

PID
Process
Filename
Type
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF103ccc.TMP —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\fafc06cf-a5fe-41fd-bdab-713cb925f754.tmpbinary
MD5:5058F1AF8388633F609CADB75A75DC9D
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:456D3EF989973A7C218E338A6CFFAD25
SHA256:75631D994431F254B94255C50038A3657BFC45D76FCE9D794D514E57CA678872
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF103ccc.TMPtext
MD5:ECD3386BCC950E73B86EB128A5F57622
SHA256:C9A068EAFBC587EDFC89392F64DDD350EEB96C5CF195CDB030BAB8F6DD33833B
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF104681.TMP —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF103f1e.TMPtext
MD5:E53573A93829681410D5E7DBB1B61C78
SHA256:A82D28F2C1E22A2AE0ABC5F5AF0CC8EE7AD913BAB3A0BF84CE6D8D23F67E06A3
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old~RF1059ba.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
55
DNS requests
63
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
748
chrome.exe
74.125.193.84:443
accounts.google.com
GOOGLE
US
unknown
3988
chrome.exe
239.255.255.250:1900
—
—
—
unknown
748
chrome.exe
104.18.249.37:443
support.logi.com
CLOUDFLARENET
—
unknown
748
chrome.exe
104.18.70.113:443
static.zdassets.com
CLOUDFLARENET
—
unknown
748
chrome.exe
104.17.25.14:443
cdnjs.cloudflare.com
CLOUDFLARENET
—
unknown
748
chrome.exe
104.18.248.37:443
support.logi.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 74.125.193.84
shared
support.logi.com
  • 104.18.249.37
  • 104.18.248.37
whitelisted
static.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
p23.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
unknown
use.fontawesome.com
  • 172.67.142.245
  • 104.21.27.152
whitelisted
tags.tiqcdn.com
  • 13.33.187.58
  • 13.33.187.60
  • 13.33.187.116
  • 13.33.187.32
whitelisted
cdn.jsdelivr.net
  • 151.101.193.229
  • 151.101.1.229
  • 151.101.65.229
  • 151.101.129.229
whitelisted
cdn.yellowmessenger.com
  • 104.18.0.51
  • 104.18.1.51
unknown
cdnjs.cloudflare.com
  • 104.17.25.14
  • 104.17.24.14
whitelisted
theme.zdassets.com
  • 104.18.72.113
  • 104.18.70.113
whitelisted

Threats

PID
Process
Class
Message
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
Process
Message
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - EventWaitHandle result (createdNew=True): System.Threading.EventWaitHandle
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Obtained EventWaitHandleSecurity: System.Security.AccessControl.EventWaitHandleSecurity
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Registered threadpool wait handle callback (done)
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Added EventWaitHandleAccessRule for Everyone
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Global Shutdown event key: Global\LPresenterInstallDoneGlobal-{8644BAC0-C5C3-4a6f-B1E3-C30D7DC8ABD1}
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://support.logi.com/hc/en-us/articles/360024844213--Downloads-Spotlight-Presentation-Remote