File name:

GoToMeeting Opener.exe

Full analysis: https://app.any.run/tasks/e081d048-631c-4690-809b-55aa401c75f8
Verdict: Malicious activity
Analysis date: March 11, 2024, 10:28:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

12A88E33273F8E8137CB3CFD1737E3D3

SHA1:

D883C061CF75F67D7AD4FC05A883F714128A95E8

SHA256:

9E8B4728254A459B9E25EFCDA0EA25CA3E1388594984AC76E177E7C7E134FC6D

SSDEEP:

12288:oX3lnSgpZQ9sLx+sA1o+5bh60C7DrhDaMBVRhdBVqy1m8hSRR:oX3lRpusLx+sA1o6N60Cky1mB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • G2MInstaller.exe (PID: 2340)

    • Registers / Runs the DLL via REGSVR32.EXE

      • g2mlauncher.exe (PID: 3912)

    • Changes the autorun value in the registry

      • g2mlauncher.exe (PID: 3912)

    • Actions looks like stealing of personal data

      • g2mcomm.exe (PID: 2420)

    • Steals credentials from Web Browsers

      • g2mcomm.exe (PID: 2420)

  • SUSPICIOUS

    • Reads the Internet Settings

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • g2mlauncher.exe (PID: 3912)
      • g2mcomm.exe (PID: 2420)

    • Reads security settings of Internet Explorer

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)

    • Executable content was dropped or overwritten

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • G2MInstaller.exe (PID: 2340)

    • Checks Windows Trust Settings

      • GoToMeeting Opener.exe (PID: 3668)

    • Reads settings of System Certificates

      • GoToMeeting Opener.exe (PID: 3668)
      • g2mcomm.exe (PID: 2420)

    • Starts itself from another location

      • G2MInstaller.exe (PID: 2340)

    • Uses RUNDLL32.EXE to load library

      • G2MInstaller.exe (PID: 2340)

    • Creates a software uninstall entry

      • G2MInstaller.exe (PID: 2340)

    • Changes Internet Explorer settings (feature browser emulation)

      • g2mlauncher.exe (PID: 3912)

    • Executing commands from a ".bat" file

      • GoToMeeting Opener.exe (PID: 3668)

    • Connects to unusual port

      • g2mcomm.exe (PID: 2420)

    • Starts CMD.EXE for commands execution

      • GoToMeeting Opener.exe (PID: 3668)

  • INFO

    • Create files in a temporary directory

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • G2MInstaller.exe (PID: 2340)
      • g2mlauncher.exe (PID: 3912)
      • g2mstart.exe (PID: 3092)
      • g2mcomm.exe (PID: 2420)

    • Reads the computer name

      • GoToMeeting Opener.exe (PID: 3668)
      • wmpnscfg.exe (PID: 1040)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • G2MInstaller.exe (PID: 2340)
      • G2MInstaller.exe (PID: 2580)
      • g2mstart.exe (PID: 3092)
      • g2mcomm.exe (PID: 2420)
      • g2mlauncher.exe (PID: 3912)

    • Checks supported languages

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • wmpnscfg.exe (PID: 1040)
      • G2MInstaller.exe (PID: 2340)
      • G2MInstaller.exe (PID: 2580)
      • g2mstart.exe (PID: 3092)
      • g2mcomm.exe (PID: 2420)
      • g2mlauncher.exe (PID: 3912)

    • Checks proxy server information

      • GoToMeeting Opener.exe (PID: 3668)
      • g2mlauncher.exe (PID: 3912)
      • g2mcomm.exe (PID: 2420)

    • Process checks whether UAC notifications are on

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MCoreInstExtractor.exe (PID: 3460)
      • G2MInstaller.exe (PID: 2340)
      • g2mstart.exe (PID: 3092)
      • g2mcomm.exe (PID: 2420)
      • g2mlauncher.exe (PID: 3912)

    • Reads the software policy settings

      • GoToMeeting Opener.exe (PID: 3668)
      • g2mcomm.exe (PID: 2420)

    • Reads the machine GUID from the registry

      • GoToMeeting Opener.exe (PID: 3668)
      • g2mcomm.exe (PID: 2420)
      • g2mlauncher.exe (PID: 3912)

    • Creates files or folders in the user directory

      • GoToMeeting Opener.exe (PID: 3668)
      • G2MInstaller.exe (PID: 2340)
      • g2mlauncher.exe (PID: 3912)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (30.7)
.exe | UPX compressed Win32 Executable (30.1)
.exe | Win32 EXE Yoda's Crypter (29.5)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:04:21 15:35:25+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 299008
InitializedDataSize: 73728
UninitializedDataSize: 823296
EntryPoint: 0x1118a0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.544
ProductVersionNumber: 1.0.0.544
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: LogMeIn, Inc.
LegalCopyright: Copyright © 2012-2021 LogMeIn, Inc.
ProductName: GoTo Opener
FileDescription: GoTo Opener
InternalName: GoToOpener
OriginalFileName: GoToOpener.exe
FileVersion: 1.0.0.544
ProductVersion: 1.0.0.544
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gotomeeting opener.exe g2mcoreinstextractor.exe wmpnscfg.exe no specs g2minstaller.exe g2minstaller.exe no specs rundll32.exe no specs g2mstart.exe no specs g2mcomm.exe g2mlauncher.exe regsvr32.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1040"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1404C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\6315B81D-51F5-49D0-AA38-A6D01074A9D7.bat" "C:\Users\admin\AppData\Local\Temp\GoToMeeting Opener.exe""C:\Windows\System32\cmd.exe—GoToMeeting Opener.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2340"C:\Users\admin\AppData\Local\Temp\CD643EC8-1A72-49F7-AD2A-90EACE9F00BF\G2MInstaller.exe" "/Action Host" "/Defaults 831" "/DidInstall True" "/EGWAddress 216.115.208.230" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 80,443,8200" "/MeetingEnabled true" "/Mode normal" "/Product g2m" "/colClientUiReadyEvent Global\CA62CB33-4924-44E2-B403-0C5FC180E799" -delself "/env live" "/sessionTrackingId clsInstall-332b7dc5-0f24-4761-82dc-e8302b0724c0"C:\Users\admin\AppData\Local\Temp\CD643EC8-1A72-49F7-AD2A-90EACE9F00BF\G2MInstaller.exe
G2MCoreInstExtractor.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\temp\cd643ec8-1a72-49f7-ad2a-90eace9f00bf\g2minstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\temp\cd643ec8-1a72-49f7-ad2a-90eace9f00bf\g2m.dll
2420"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mcomm.exe" "Action=Host&colClientUiReadyEvent=Global\CA62CB33-4924-44E2-B403-0C5FC180E799&Defaults=831&DidInstall=True&Digest=e04ce44cea574792757aca25765dc1d9&Dir=C:\Users\admin\AppData\Local\GoToMeeting\19228\&EGWAddress=216.115.208.230&EGWDNS=egwglobal.gotomeeting.com&EGWPort=80,443,8200&env=live&LoaderPath=C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mstart.exe&LogName=c:\users\admin\appdata\local\temp\logmeinlogs\gotomeeting\19228\2024-03-11_10.28.37.794\GoToMeeting.log&MeetingEnabled=true&Mode=normal&Path=g2mlauncher.exe&Plugin=G2MLauncher&Product=g2m&sessionTrackingId=clsInstall-332b7dc5-0f24-4761-82dc-e8302b0724c0&UniqueId=c14"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mcomm.exe
g2mstart.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19228\g2mcomm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\19228\g2m.dll
2572rundll32.exe "C:\Users\admin\AppData\Local\Temp\CD643EC8-1A72-49F7-AD2A-90EACE9F00BF\uninshlp.dll",DeleteExeAndDeleteSelf 4a11cabe-b9a2-4fd5-b17e-9a9fdbc8056eC:\Windows\System32\rundll32.exe—G2MInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2580"C:\Users\admin\AppData\Local\GoToMeeting\19228\G2MInstaller.exe" -noopC:\Users\admin\AppData\Local\GoToMeeting\19228\G2MInstaller.exe—G2MInstaller.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19228\g2minstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\19228\g2m.dll
3092"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mstart.exe" "/Action Host" "/Defaults 831" "/DidInstall True" "/EGWAddress 216.115.208.230" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 80,443,8200" "/MeetingEnabled true" "/Mode normal" "/Product g2m" "/colClientUiReadyEvent Global\CA62CB33-4924-44E2-B403-0C5FC180E799" "/env live" "/sessionTrackingId clsInstall-332b7dc5-0f24-4761-82dc-e8302b0724c0"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mstart.exe—G2MInstaller.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19228\g2mstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\19228\g2m.dll
3460"C:\Users\admin\AppData\Local\Temp\CD643EC8-1A72-49F7-AD2A-90EACE9F00BF\G2MCoreInstExtractor.exe" "/Action Host" "/Defaults 831" "/EGWAddress 216.115.208.230" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 80,443,8200" "/MeetingEnabled true" "/Mode normal" "/Product g2m" "/colClientUiReadyEvent Global\CA62CB33-4924-44E2-B403-0C5FC180E799" "/env live" "/sessionTrackingId clsInstall-332b7dc5-0f24-4761-82dc-e8302b0724c0"C:\Users\admin\AppData\Local\Temp\CD643EC8-1A72-49F7-AD2A-90EACE9F00BF\G2MCoreInstExtractor.exe
GoToMeeting Opener.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting Installer Extractor
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\temp\cd643ec8-1a72-49f7-ad2a-90eace9f00bf\g2mcoreinstextractor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3668"C:\Users\admin\AppData\Local\Temp\GoToMeeting Opener.exe" C:\Users\admin\AppData\Local\Temp\GoToMeeting Opener.exe
explorer.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoTo Opener
Exit code:
0
Version:
1.0.0.544
Modules
Images
c:\users\admin\appdata\local\temp\gotomeeting opener.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3912"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mlauncher.exe" "StartID={F3580263-C43F-463F-AFE3-6EFBAD76BEE2}&Debug=Off&Stat=On&StatDb=On&Index=0"C:\Users\admin\AppData\Local\GoToMeeting\19228\g2mlauncher.exe
g2mcomm.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.15.0 Build 19228
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19228\g2mlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\19228\g2m.dll
Total events
26 214
Read events
25 948
Write events
243
Delete events
23

Modification events

(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\LogMeInInc\GoTo Opener
Operation:writeName:UUID
Value:
{138C6CA6-0E5B-4696-9AF3-A51C854FDB86}
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3668) GoToMeeting Opener.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
49
Suspicious files
10
Text files
4
Unknown types
7

Dropped files

PID
Process
Filename
Type
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:87FD3FB7961B3FF5A38184F77F98C426
SHA256:A7CAF4190800558B7E1F110C4B2CD190D98360933FFFFF271958614BE3E83C1F
3668GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\BBA65B53-8B82-4460-BBC6-A812A81F0EB7\GoTo Opener.exeexecutable
MD5:E2620CC8D8834F867D4805FBE10D29E6
SHA256:F0E58AB2FCDFAD3E757653EF684109EE525BDFBC817E845DD8925CED4CF393BD
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:220BC8F796C5AA021F85AA60FA47A9E5
SHA256:74EB3F2B46733EA2246AFE1941C3DB831E4EA9C59D5A22BF15E4142DE52DE87A
3460G2MCoreInstExtractor.exeC:\Users\admin\AppData\Local\Temp\CD643EC8-1A72-49F7-AD2A-90EACE9F00BF\G2M.Dll —
MD5:—
SHA256:—
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:0C8439923F749C3DF10BBC4333E9B521
SHA256:E21B4BE922282AB191263FF18D4F0202888A331A07038D6B40D4EECEE0572CAA
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656der
MD5:F35066A32F2181D0AE2D5090FBE83586
SHA256:91930D635093CE347E13477EEADDCDF1595F1E2AEE4A7FBD5F87A0B1C0BB4357
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656binary
MD5:36BBD0BEFBA1BE5ABC1631E6D5DC4A23
SHA256:746D7288A5CEA2B82CBC4A6DACC6D004F1C9EA05CF9A7190BD57AC2441E91EE7
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419der
MD5:36A07379AD0F0D48A715ABF3FA602187
SHA256:1F6F1058ED39F9876ECA43731DDC3780422D032ADE3F9ADAFDAF10C361442EA2
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_473C73009D25D3B712169065C1512FDAbinary
MD5:D837D6B560117C6748710516E311C9FE
SHA256:24E84AF22614A5CDB9F23B3EC145F855F26FEEB5452ADE1357F301E225A25ABA
3668GoToMeeting Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:D6AA5869CD10151D32251690A8644E59
SHA256:033B85C630911387C814B0C7DF936FFBF54FAF31528ED1658EF38277B2630C70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
22
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3668
GoToMeeting Opener.exe
GET
304
23.223.28.54:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c41d92d6b09abc02
unknown
—
—
unknown
3668
GoToMeeting Opener.exe
GET
304
23.223.28.54:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?54637f8936655088
unknown
—
—
unknown
3668
GoToMeeting Opener.exe
GET
200
108.138.2.107:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3668
GoToMeeting Opener.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
3668
GoToMeeting Opener.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
binary
1.37 Kb
unknown
3668
GoToMeeting Opener.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3668
GoToMeeting Opener.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAPSB3NzcJpWVuHKKfDXs2w%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
23.223.28.54:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?624d1ab720bef5f8
unknown
compressed
67.5 Kb
unknown
1080
svchost.exe
GET
200
23.223.28.54:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0754c686571bd23f
unknown
compressed
67.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3668
GoToMeeting Opener.exe
23.239.230.239:443
launch.getgo.com
ORACLE-BMC-31898
US
unknown
3668
GoToMeeting Opener.exe
18.173.187.104:443
builds.cdn.getgo.com
—
US
unknown
3668
GoToMeeting Opener.exe
23.223.28.54:80
ctldl.windowsupdate.com
Akamai International B.V.
US
unknown
3668
GoToMeeting Opener.exe
108.138.2.107:80
o.ss2.us
AMAZON-02
US
whitelisted
3668
GoToMeeting Opener.exe
18.245.39.64:80
ocsp.rootg2.amazontrust.com
—
US
unknown
3668
GoToMeeting Opener.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
launch.getgo.com
  • 23.239.230.239
whitelisted
join.servers.getgo.com
  • —
unknown
builds.cdn.getgo.com
  • 18.173.187.104
  • 18.173.187.110
  • 18.173.187.127
  • 18.173.187.102
shared
ctldl.windowsupdate.com
  • 23.223.28.54
  • 23.223.28.48
whitelisted
o.ss2.us
  • 108.138.2.107
  • 108.138.2.10
  • 108.138.2.195
  • 108.138.2.173
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.245.39.64
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.245.39.64
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted
egwglobal.gotomeeting.com
  • 173.199.10.247
whitelisted

Threats

No threats detected
Process
Message
GoToMeeting Opener.exe
setSafeDllSearchPath()
GoToMeeting Opener.exe
preLoadDllsFromSystem()
GoToMeeting Opener.exe
C:\Windows\system32\MSVCRT.DLL
GoToMeeting Opener.exe
GoToMeeting Opener.exe
C:\Windows\system32\BCRYPTPRIMITIVES.DLL
GoToMeeting Opener.exe
GoToMeeting Opener.exe
C:\Windows\system32\CRYPTBASE.DLL
GoToMeeting Opener.exe
GoToMeeting Opener.exe
C:\Windows\system32\SECUR32.DLL
GoToMeeting Opener.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GoToMeeting Opener.exe