URL:

https://support.logi.com/hc/en-us/articles/360024844213--Downloads-Spotlight-Presentation-Remote

Full analysis: https://app.any.run/tasks/a83c51c6-650d-499c-a67b-076845aa3b44
Verdict: Malicious activity
Analysis date: May 07, 2024, 16:47:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5C75EDF69369D3552EB1E76AC83D79AB

SHA1:

577B3CD4237DF0D91F9D3AD56E95988DE6FF9F3B

SHA256:

C5947BB3BC0ADC725EDB70883D93FBF1F8A2326C728ED26B62A559DC6EA8B905

SSDEEP:

3:N8dCBLJXBb8IWKMVFSPI3EEgIZv41DuiRA3tKm:2wBLJBbSKNwdNRSaB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)

    • Changes the autorun value in the registry

      • Setup.exe (PID: 3052)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)

    • Executable content was dropped or overwritten

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3080)
      • PDSetup.exe (PID: 3112)
      • Setup.exe (PID: 3052)

    • The process creates files with name similar to system file names

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)

    • Reads the Internet Settings

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUI.exe (PID: 1800)

    • Checks Windows Trust Settings

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads settings of System Certificates

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads Internet Explorer settings

      • LogiPresentationInstaller.exe (PID: 2772)

    • Reads security settings of Internet Explorer

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUI.exe (PID: 1800)

    • Creates a software uninstall entry

      • Setup.exe (PID: 3052)

    • Process drops legitimate windows executable

      • PDSetup.exe (PID: 3112)

    • The process drops C-runtime libraries

      • PDSetup.exe (PID: 3112)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3988)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2268)
      • LogiPresentation_1.60.33.exe (PID: 2992)
      • LogiPresentationInstaller.exe (PID: 2772)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)
      • LogiPresentationUpdater.exe (PID: 1792)
      • LogiPresentationMgr.exe (PID: 3800)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2268)
      • LogiPresentation_1.60.33.exe (PID: 2992)
      • LogiPresentationInstaller.exe (PID: 2772)
      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • RunNE.exe (PID: 3140)
      • PDSetup.exe (PID: 3112)
      • RunNE.exe (PID: 3284)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationMgr.exe (PID: 3576)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationUpdater.exe (PID: 1792)
      • LogiPresentationMgr.exe (PID: 588)
      • LogiPresentationMgr.exe (PID: 1012)
      • LogiPresentationUI.exe (PID: 1800)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2268)
      • PDSetup.exe (PID: 3112)
      • LogiPresentation.exe (PID: 3264)
      • LogiPresentation.exe (PID: 3496)

    • The process uses the downloaded file

      • chrome.exe (PID: 2708)
      • chrome.exe (PID: 3988)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 3848)
      • chrome.exe (PID: 2840)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 2840)
      • chrome.exe (PID: 3848)

    • Create files in a temporary directory

      • LogiPresentation_1.60.33.exe (PID: 2992)
      • LogiPresentationInstaller.exe (PID: 2772)
      • Setup.exe (PID: 3080)
      • PDSetup.exe (PID: 3112)
      • Setup.exe (PID: 3052)

    • Reads the machine GUID from the registry

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • Setup.exe (PID: 3052)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads the software policy settings

      • LogiPresentationInstaller.exe (PID: 2772)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Creates files in the program directory

      • Setup.exe (PID: 3080)
      • Setup.exe (PID: 3052)
      • PDSetup.exe (PID: 3112)
      • LogiPresentation.exe (PID: 3496)
      • LogiPresentationMgr.exe (PID: 3800)
      • LogiPresentationOnboarding.exe (PID: 3500)

    • Process checks computer location settings

      • Setup.exe (PID: 3080)
      • PDSetup.exe (PID: 3112)
      • Setup.exe (PID: 3052)
      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)

    • Reads Environment values

      • Setup.exe (PID: 3052)

    • Creates files or folders in the user directory

      • LogiPresentationOnboarding.exe (PID: 3500)
      • LogiPresentationUI.exe (PID: 1800)
      • LogiPresentationMgr.exe (PID: 3800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
44
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs logipresentation_1.60.33.exe no specs logipresentation_1.60.33.exe logipresentationinstaller.exe setup.exe setup.exe runne.exe no specs pdsetup.exe runne.exe no specs logipresentation.exe no specs logipresentation.exe logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationonboarding.exe logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationui.exe logipresentationupdater.exe logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationmgr.exe no specs logipresentationmgr.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
112"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1516 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2012 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3128 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
552"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2024 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
588"C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe" C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe—LogiPresentationUI.exe
User:
admin
Company:
Logitech, Inc.
Integrity Level:
MEDIUM
Description:
Logi Presentation Manager.exe (UNICODE)
Exit code:
0
Version:
1.60.33
Modules
Images
c:\programdata\logishrd\logipresentation\software\1.60.33\logipresentationmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
748"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1292 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
920"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3828 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1012"C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe" C:\ProgramData\Logishrd\LogiPresentation\Software\1.60.33\LogiPresentationMgr.exe—LogiPresentationUI.exe
User:
admin
Company:
Logitech, Inc.
Integrity Level:
MEDIUM
Description:
Logi Presentation Manager.exe (UNICODE)
Exit code:
0
Version:
1.60.33
Modules
Images
c:\programdata\logishrd\logipresentation\software\1.60.33\logipresentationmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=872 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1244"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3368 --field-trial-handle=1168,i,1117334135831838817,2964213590998632800,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
33 993
Read events
33 740
Write events
243
Delete events
10

Modification events

(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
141
Suspicious files
63
Text files
78
Unknown types
217

Dropped files

PID
Process
Filename
Type
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF103ccc.TMP —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC
SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old~RF103f9b.TMPtext
MD5:BF244CDEBD39A0D20444C1578C0200BE
SHA256:CC7E247D7764DA50D4137E894838F918281D4915FE0823B4FC0CB763BF582F4D
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:456D3EF989973A7C218E338A6CFFAD25
SHA256:75631D994431F254B94255C50038A3657BFC45D76FCE9D794D514E57CA678872
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF104681.TMP —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:825B582C78EC88D54C215EFDF1EAD639
SHA256:367995D01A8F13E5C30C79499F86B034775BFD009D83DC97635DE438D47DFA37
3988chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old~RF1059ba.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
55
DNS requests
63
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
748
chrome.exe
74.125.193.84:443
accounts.google.com
GOOGLE
US
unknown
3988
chrome.exe
239.255.255.250:1900
—
—
—
unknown
748
chrome.exe
104.18.249.37:443
support.logi.com
CLOUDFLARENET
—
unknown
748
chrome.exe
104.18.70.113:443
static.zdassets.com
CLOUDFLARENET
—
unknown
748
chrome.exe
104.17.25.14:443
cdnjs.cloudflare.com
CLOUDFLARENET
—
unknown
748
chrome.exe
104.18.248.37:443
support.logi.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 74.125.193.84
shared
support.logi.com
  • 104.18.249.37
  • 104.18.248.37
whitelisted
static.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
p23.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
unknown
use.fontawesome.com
  • 172.67.142.245
  • 104.21.27.152
whitelisted
tags.tiqcdn.com
  • 13.33.187.58
  • 13.33.187.60
  • 13.33.187.116
  • 13.33.187.32
whitelisted
cdn.jsdelivr.net
  • 151.101.193.229
  • 151.101.1.229
  • 151.101.65.229
  • 151.101.129.229
whitelisted
cdn.yellowmessenger.com
  • 104.18.0.51
  • 104.18.1.51
unknown
cdnjs.cloudflare.com
  • 104.17.25.14
  • 104.17.24.14
whitelisted
theme.zdassets.com
  • 104.18.72.113
  • 104.18.70.113
whitelisted

Threats

PID
Process
Class
Message
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
748
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
Process
Message
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - EventWaitHandle result (createdNew=True): System.Threading.EventWaitHandle
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Obtained EventWaitHandleSecurity: System.Security.AccessControl.EventWaitHandleSecurity
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Registered threadpool wait handle callback (done)
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Added EventWaitHandleAccessRule for Everyone
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
RegisterGlobalShutdownEvent() - Global Shutdown event key: Global\LPresenterInstallDoneGlobal-{8644BAC0-C5C3-4a6f-B1E3-C30D7DC8ABD1}
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
LogiPresentationInstaller.exe
LogiPresentationInstaller.exe Information: 0 :
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://support.logi.com/hc/en-us/articles/360024844213--Downloads-Spotlight-Presentation-Remote