URL:

https://goto.secondopinion.net/

Full analysis: https://app.any.run/tasks/2739119c-9220-4f05-828a-81c97ccd87d0
Verdict: Malicious activity
Analysis date: February 02, 2024, 13:05:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E8F51EBEDDD20FE6BDB492FE99A15E0C

SHA1:

ECF14B85D75A4B1AA0CB111DA49C5C4D3C5D2DEE

SHA256:

124041E5BC544B4AB3463AD2FEBC67F0269DD65C84970EB815DC719F83139EE3

SSDEEP:

3:N8ryd1H0Kn:24zn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • GoToOpener.exe (PID: 3636)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • G2MInstaller.exe (PID: 3272)

    • Registers / Runs the DLL via REGSVR32.EXE

      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)

    • Actions looks like stealing of personal data

      • g2mcomm.exe (PID: 3056)

    • Steals credentials from Web Browsers

      • g2mcomm.exe (PID: 3056)

  • SUSPICIOUS

    • Reads the Internet Settings

      • GoToOpener.exe (PID: 3636)
      • GoToOpener (1).exe (PID: 3688)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • g2mlauncher.exe (PID: 3020)
      • g2mcomm.exe (PID: 3056)
      • g2mlauncher.exe (PID: 2780)

    • Executable content was dropped or overwritten

      • GoToOpener.exe (PID: 3636)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • G2MInstaller.exe (PID: 3272)

    • Checks Windows Trust Settings

      • GoToOpener.exe (PID: 3636)
      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)

    • Reads security settings of Internet Explorer

      • GoToOpener.exe (PID: 3636)
      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)

    • Reads settings of System Certificates

      • GoToOpener.exe (PID: 3636)
      • g2mcomm.exe (PID: 3056)
      • g2mlauncher.exe (PID: 3020)
      • g2mcomm.exe (PID: 3572)
      • g2mlauncher.exe (PID: 2780)

    • Starts itself from another location

      • G2MInstaller.exe (PID: 3272)

    • Uses RUNDLL32.EXE to load library

      • G2MInstaller.exe (PID: 3272)

    • Executing commands from a ".bat" file

      • GoToOpener.exe (PID: 3636)

    • Connects to unusual port

      • g2mcomm.exe (PID: 3056)

    • Reads Microsoft Outlook installation path

      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)

    • Starts CMD.EXE for commands execution

      • GoToOpener.exe (PID: 3636)

    • Reads Internet Explorer settings

      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 1604)
      • iexplore.exe (PID: 572)
      • chrome.exe (PID: 2844)
      • chrome.exe (PID: 2996)

    • Application launched itself

      • iexplore.exe (PID: 572)
      • chrome.exe (PID: 2996)

    • Checks supported languages

      • GoToOpener.exe (PID: 3636)
      • GoToOpener (1).exe (PID: 3688)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • G2MInstaller.exe (PID: 2136)
      • g2mstart.exe (PID: 1548)
      • g2mcomm.exe (PID: 3056)
      • G2MInstaller.exe (PID: 3272)
      • g2mlauncher.exe (PID: 3020)
      • g2mupload.exe (PID: 1056)
      • g2mcomm.exe (PID: 3572)
      • g2mlauncher.exe (PID: 2780)
      • g2mstart.exe (PID: 2976)
      • g2mupload.exe (PID: 2968)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 1604)
      • chrome.exe (PID: 2996)
      • chrome.exe (PID: 2844)

    • The process uses the downloaded file

      • iexplore.exe (PID: 572)
      • chrome.exe (PID: 392)
      • chrome.exe (PID: 2996)

    • Reads the computer name

      • GoToOpener.exe (PID: 3636)
      • GoToOpener (1).exe (PID: 3688)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • G2MInstaller.exe (PID: 3272)
      • G2MInstaller.exe (PID: 2136)
      • g2mstart.exe (PID: 1548)
      • g2mcomm.exe (PID: 3056)
      • g2mlauncher.exe (PID: 3020)
      • g2mupload.exe (PID: 1056)
      • g2mcomm.exe (PID: 3572)
      • g2mlauncher.exe (PID: 2780)
      • g2mupload.exe (PID: 2968)
      • g2mstart.exe (PID: 2976)

    • Manual execution by a user

      • GoToOpener.exe (PID: 3636)
      • chrome.exe (PID: 2996)
      • g2mstart.exe (PID: 2976)

    • Process checks whether UAC notifications are on

      • GoToOpener.exe (PID: 3636)
      • GoToOpener (1).exe (PID: 3688)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • G2MInstaller.exe (PID: 3272)
      • g2mstart.exe (PID: 1548)
      • g2mcomm.exe (PID: 3056)
      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)
      • g2mupload.exe (PID: 1056)
      • g2mcomm.exe (PID: 3572)
      • g2mstart.exe (PID: 2976)
      • g2mupload.exe (PID: 2968)

    • Checks proxy server information

      • GoToOpener.exe (PID: 3636)
      • GoToOpener (1).exe (PID: 3688)
      • g2mlauncher.exe (PID: 3020)
      • g2mcomm.exe (PID: 3056)
      • g2mlauncher.exe (PID: 2780)

    • Create files in a temporary directory

      • GoToOpener.exe (PID: 3636)
      • G2MCoreInstExtractor.exe (PID: 2936)
      • G2MInstaller.exe (PID: 3272)
      • g2mstart.exe (PID: 1548)
      • g2mcomm.exe (PID: 3056)
      • g2mlauncher.exe (PID: 3020)
      • g2mcomm.exe (PID: 3572)
      • g2mupload.exe (PID: 1056)
      • g2mlauncher.exe (PID: 2780)
      • g2mupload.exe (PID: 2968)
      • g2mstart.exe (PID: 2976)

    • Reads the machine GUID from the registry

      • GoToOpener.exe (PID: 3636)
      • g2mlauncher.exe (PID: 3020)
      • g2mcomm.exe (PID: 3056)
      • g2mupload.exe (PID: 1056)
      • g2mcomm.exe (PID: 3572)
      • g2mlauncher.exe (PID: 2780)
      • g2mupload.exe (PID: 2968)

    • Creates files or folders in the user directory

      • GoToOpener.exe (PID: 3636)
      • G2MInstaller.exe (PID: 3272)
      • g2mlauncher.exe (PID: 3020)
      • g2mlauncher.exe (PID: 2780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
40
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe gotoopener.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs gotoopener (1).exe g2mcoreinstextractor.exe g2minstaller.exe g2minstaller.exe no specs g2mstart.exe no specs rundll32.exe no specs g2mcomm.exe g2mlauncher.exe regsvr32.exe no specs cmd.exe no specs g2mupload.exe no specs g2mcomm.exe g2mlauncher.exe chrome.exe no specs regsvr32.exe no specs chrome.exe no specs g2mstart.exe no specs g2mupload.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3852 --field-trial-handle=1172,i,2687131422317442279,5042769410788993151,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
572"C:\Program Files\Internet Explorer\iexplore.exe" "https://goto.secondopinion.net/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1056"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mupload.exe" "Action=GenCrashDump&ExPointers=02B2F880&HEventReady=G2MExceptionHandler-89A2D1A9-FDD2-47A7-81A9-7829F2BBDC63&LogFolder=c%3a%5cusers%5cadmin%5cappdata%5clocal%5ctemp%5clogmeinlogs%5cgotomeeting%5c19228%5c2024-02-02_13.09.15.221%5c&ProcessId=3020&ThreadId=3432"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mupload.exe—g2mlauncher.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19228\g2mupload.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\19228\g2m.dll
1536"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=2836 --field-trial-handle=1172,i,2687131422317442279,5042769410788993151,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1548"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mstart.exe" "/Action Host" "/Defaults 831" "/DidInstall True" "/EGWAddress 216.115.208.230" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 80,443,8200" "/MeetingEnabled true" "/Mode normal" "/Product g2m" "/colClientUiReadyEvent Global\29B5D331-0A8A-4231-8B6D-0703112E3838" "/env live" "/sessionTrackingId clsInstall-a0f761f4-3578-421c-8695-7e38bcc0b77c"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mstart.exe—G2MInstaller.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19228\g2mstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\19228\g2m.dll
1604"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:572 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2144 --field-trial-handle=1172,i,2687131422317442279,5042769410788993151,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1808"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3656 --field-trial-handle=1172,i,2687131422317442279,5042769410788993151,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1992"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1480 --field-trial-handle=1172,i,2687131422317442279,5042769410788993151,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1172,i,2687131422317442279,5042769410788993151,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
52 452
Read events
52 057
Write events
380
Delete events
15

Modification events

(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(572) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
58
Suspicious files
99
Text files
68
Unknown types
0

Dropped files

PID
Process
Filename
Type
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C18D667B4E00F31BEE5F85754FABB980
SHA256:CA6433FB279946B8ACAF4699A0079F48ABB49562DACD0DF9A65EA2161712D450
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:CEAB9D438F7AFBF511EFBD5B1993A7EA
SHA256:8E2034B94FC744B5175AC3DF46B0293142D7F0370CBAD82AE1C90CFB3A6DA671
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery-1.7.1.min[1].jshtml
MD5:DDB84C1587287B2DF08966081EF063BF
SHA256:88171413FC76DDA23AB32BAA17B11E4FFF89141C633ECE737852445F1BA6C1BD
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\index[1].jstext
MD5:3EC6AF84AA8344967FD2354DF2FF86C5
SHA256:C12A29BA4576D5B0C9F8D29617A512258C81626164B6BF82FC8BF645F733F5EC
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:2C635DABC8EADD28B9E394EEFC853D99
SHA256:C4133A51A1FEB8D0353EB34A2F8C790368D66999CE177E51BCEAE9911FE58797
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon-32x32[1].pngimage
MD5:E8895937D32B58D8D630834AAAC99005
SHA256:F50A063657210CEE553D2BE21B214F8CE2201D66402A0A5048535F1D538C597F
572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:608B181C27D81F1EB67E52A62A5B27A6
SHA256:3127900225518FD7C717266520271F7399DF506820E50105D31B0CA0FEFA3188
572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:E38D32113B8D4F89E452CE180A7D6257
SHA256:2CF781F07FC6DA0DA6A56AFE37E61D930C502DC5B6F639569F99690DE18E5E58
572iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
74
DNS requests
59
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1604
iexplore.exe
GET
304
23.32.238.209:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?245ab6ffaf4de696
unknown
—
—
unknown
1604
iexplore.exe
GET
304
23.32.238.209:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bd6d7f2a69dae365
unknown
—
—
unknown
572
iexplore.exe
GET
304
23.32.238.209:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3867b918e511e106
unknown
—
—
unknown
572
iexplore.exe
GET
304
23.32.238.209:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f21ede4db813e6d
unknown
—
—
unknown
1604
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
572
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
1080
svchost.exe
GET
200
23.32.238.233:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fc91d912a85a08d5
unknown
compressed
65.2 Kb
unknown
3636
GoToOpener.exe
GET
200
108.138.34.92:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3636
GoToOpener.exe
GET
200
18.66.190.71:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
3636
GoToOpener.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1604
iexplore.exe
13.56.64.10:443
goto.secondopinion.net
AMAZON-02
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1604
iexplore.exe
23.32.238.209:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1604
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
572
iexplore.exe
13.56.64.10:443
goto.secondopinion.net
AMAZON-02
US
unknown
572
iexplore.exe
23.32.238.209:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
572
iexplore.exe
23.36.162.68:443
www.bing.com
Akamai International B.V.
DE
unknown
572
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
goto.secondopinion.net
  • 13.56.64.10
unknown
ctldl.windowsupdate.com
  • 23.32.238.209
  • 23.32.238.235
  • 23.32.238.219
  • 23.32.238.202
  • 23.32.238.225
  • 23.32.238.232
  • 23.32.238.224
  • 23.32.238.208
  • 23.32.238.216
  • 23.32.238.233
  • 23.32.238.171
  • 23.32.238.169
  • 23.32.238.241
  • 23.32.238.242
  • 23.32.238.240
  • 23.32.238.243
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 23.36.162.68
  • 23.36.162.84
  • 92.123.104.21
  • 92.123.104.20
  • 92.123.104.17
  • 92.123.104.18
  • 92.123.104.24
  • 92.123.104.16
  • 92.123.104.23
  • 92.123.104.19
  • 92.123.104.15
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
launch.getgo.com
  • 23.239.230.239
whitelisted
join.servers.getgo.com
  • —
unknown

Threats

No threats detected
Process
Message
GoToOpener.exe
C:\Windows\system32\USER32.DLL
GoToOpener.exe
C:\Windows\system32\SECUR32.DLL
GoToOpener.exe
GoToOpener.exe
C:\Windows\system32\RPCRT4.DLL
GoToOpener.exe
GoToOpener.exe
C:\Windows\system32\SECUR32.DLL
GoToOpener.exe
C:\Windows\system32\WINTYPES.DLL
GoToOpener.exe
C:\Windows\system32\MSVCRT.DLL
GoToOpener.exe
GoToOpener.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://goto.secondopinion.net/