File name:

GoTo Webinar Opener.exe

Full analysis: https://app.any.run/tasks/82408600-fc0e-44c3-b84d-ab02610c0313
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 17, 2025, 18:56:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gotoassist
rmm-tool
shellrunner
loader
upx
ousaban
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

D92A1818ED5E586E58E885E1A897303B

SHA1:

C9D6A96901B05C6AC37AD1C2B2B0AFC3C9AA6B46

SHA256:

B34B20800E3EBFF2AA5A8893B810647DD3CA534469F5B232FD43E2A5EED23E05

SSDEEP:

12288:qDr4xkGkHncbsvljTu8ebbFFomBmxgxK79rhBaMBV7h4BV9y1d8hSr:qDrSkGUncgvljTu8OFomBzKKy1d7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SHELLRUNNER has been detected

      • G2MCoreInstExtractor.exe (PID: 3872)
      • G2MInstaller.exe (PID: 3732)
      • G2MInstaller.exe (PID: 6572)
      • g2mstart.exe (PID: 1180)
      • g2mcomm.exe (PID: 6796)
      • rundll32.exe (PID: 6344)
      • g2mlauncher.exe (PID: 4580)
      • g2mui.exe (PID: 7284)
      • g2mvideoconference.exe (PID: 7276)

    • Registers / Runs the DLL via REGSVR32.EXE

      • g2mlauncher.exe (PID: 4580)

    • OUSABAN has been detected (YARA)

      • g2mcomm.exe (PID: 6796)
      • g2mstart.exe (PID: 1180)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3572)

    • Executable content was dropped or overwritten

      • G2MCoreInstExtractor.exe (PID: 3872)
      • G2MInstaller.exe (PID: 3732)
      • GoTo Webinar Opener.exe (PID: 5552)

    • Reads security settings of Internet Explorer

      • G2MCoreInstExtractor.exe (PID: 3872)
      • g2mlauncher.exe (PID: 4580)
      • g2mcomm.exe (PID: 6796)
      • GoTo Webinar Opener.exe (PID: 5552)
      • g2mui.exe (PID: 7284)

    • Starts itself from another location

      • G2MInstaller.exe (PID: 3732)

    • Creates a software uninstall entry

      • G2MInstaller.exe (PID: 3732)

    • There is functionality for taking screenshot (YARA)

      • GoTo Webinar Opener.exe (PID: 5552)

    • Starts CMD.EXE for commands execution

      • GoTo Webinar Opener.exe (PID: 5552)

    • Executing commands from a ".bat" file

      • GoTo Webinar Opener.exe (PID: 5552)

    • Reads Internet Explorer settings

      • g2mui.exe (PID: 7284)

    • Reads Microsoft Outlook installation path

      • g2mui.exe (PID: 7284)

    • Connects to unusual port

      • g2mcomm.exe (PID: 6796)

  • INFO

    • Reads the computer name

      • GoTo Webinar Opener.exe (PID: 5552)
      • msiexec.exe (PID: 3572)
      • G2MInstaller.exe (PID: 3732)
      • G2MCoreInstExtractor.exe (PID: 3872)
      • G2MInstaller.exe (PID: 6572)
      • g2mcomm.exe (PID: 6796)
      • g2mstart.exe (PID: 1180)
      • g2mlauncher.exe (PID: 4580)
      • g2mvideoconference.exe (PID: 7276)
      • g2mui.exe (PID: 7284)

    • GOTOASSIST has been detected

      • GoTo Webinar Opener.exe (PID: 5552)
      • msiexec.exe (PID: 3572)

    • Creates files or folders in the user directory

      • GoTo Webinar Opener.exe (PID: 5552)
      • msiexec.exe (PID: 3572)
      • G2MInstaller.exe (PID: 3732)

    • The sample compiled with english language support

      • GoTo Webinar Opener.exe (PID: 5552)
      • G2MCoreInstExtractor.exe (PID: 3872)
      • msiexec.exe (PID: 3572)
      • G2MInstaller.exe (PID: 3732)

    • Checks supported languages

      • GoTo Webinar Opener.exe (PID: 5552)
      • msiexec.exe (PID: 3572)
      • G2MCoreInstExtractor.exe (PID: 3872)
      • G2MInstaller.exe (PID: 3732)
      • G2MInstaller.exe (PID: 6572)
      • g2mstart.exe (PID: 1180)
      • g2mcomm.exe (PID: 6796)
      • g2mlauncher.exe (PID: 4580)
      • g2mvideoconference.exe (PID: 7276)
      • g2mui.exe (PID: 7284)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3572)
      • GoTo Webinar Opener.exe (PID: 5552)
      • g2mlauncher.exe (PID: 4580)
      • g2mcomm.exe (PID: 6796)

    • Reads the software policy settings

      • msiexec.exe (PID: 3572)
      • GoTo Webinar Opener.exe (PID: 5552)
      • g2mcomm.exe (PID: 6796)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3572)

    • Process checks whether UAC notifications are on

      • GoTo Webinar Opener.exe (PID: 5552)
      • G2MCoreInstExtractor.exe (PID: 3872)
      • G2MInstaller.exe (PID: 3732)
      • g2mstart.exe (PID: 1180)
      • g2mcomm.exe (PID: 6796)
      • g2mlauncher.exe (PID: 4580)
      • g2mvideoconference.exe (PID: 7276)
      • g2mui.exe (PID: 7284)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3572)

    • Process checks computer location settings

      • G2MCoreInstExtractor.exe (PID: 3872)
      • g2mlauncher.exe (PID: 4580)

    • Create files in a temporary directory

      • G2MInstaller.exe (PID: 3732)
      • G2MCoreInstExtractor.exe (PID: 3872)
      • g2mstart.exe (PID: 1180)
      • g2mcomm.exe (PID: 6796)
      • g2mlauncher.exe (PID: 4580)
      • GoTo Webinar Opener.exe (PID: 5552)
      • msiexec.exe (PID: 1508)
      • g2mui.exe (PID: 7284)

    • Checks proxy server information

      • g2mlauncher.exe (PID: 4580)
      • GoTo Webinar Opener.exe (PID: 5552)
      • g2mui.exe (PID: 7284)
      • g2mcomm.exe (PID: 6796)

    • UPX packer has been detected

      • GoTo Webinar Opener.exe (PID: 5552)

    • Reads Microsoft Office registry keys

      • g2mlauncher.exe (PID: 4580)

    • Reads CPU info

      • g2mlauncher.exe (PID: 4580)
      • g2mcomm.exe (PID: 6796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (30.7)
.exe | UPX compressed Win32 Executable (30.1)
.exe | Win32 EXE Yoda's Crypter (29.5)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:23 13:44:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 299008
InitializedDataSize: 73728
UninitializedDataSize: 839680
EntryPoint: 0x116040
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.568
ProductVersionNumber: 1.0.0.568
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: LogMeIn, Inc.
LegalCopyright: Copyright © 2012-2024 LogMeIn, Inc.
ProductName: GoTo Opener
FileDescription: GoTo Opener
InternalName: GoToOpener
OriginalFileName: GoToOpener.exe
FileVersion: 1.0.0.568
ProductVersion: 1.0.0.568
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
17
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start goto webinar opener.exe msiexec.exe no specs msiexec.exe #SHELLRUNNER g2mcoreinstextractor.exe #SHELLRUNNER g2minstaller.exe #SHELLRUNNER g2minstaller.exe no specs #SHELLRUNNER g2mstart.exe no specs #SHELLRUNNER rundll32.exe no specs #SHELLRUNNER g2mcomm.exe #SHELLRUNNER g2mlauncher.exe no specs regsvr32.exe no specs regsvr32.exe no specs #SHELLRUNNER g2mvideoconference.exe no specs #SHELLRUNNER g2mui.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\Users\admin\AppData\Local\GoToMeeting\19992\g2mstart.exe" "/Action Join" "/BrokerServiceSuffix @ISL1" "/DidInstall True" "/EGWAddress 23.239.230.255" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 8200,80,443" "/MeetingID 389471699" "/Mode Terse" "/UserID 7878410280003531094" "/UserRole panelist" "/betaEnabled true" "/buildNumber 19992" "/colClientUiReadyEvent Global\59F02CC5-47E0-4F60-80FF-40B879A0FFB0" "/locale en_US" "/productName g2m" "/sessionTrackingId e0-dzE2NxYOgvBVBgTpwYJSHh7S4Hial" "/theme g2w"C:\Users\admin\AppData\Local\GoToMeeting\19992\g2mstart.exe
G2MInstaller.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Version:
10.20.0 Build 19992
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19992\g2mstart.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1508"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\994AC69D-1F1B-4EFE-9530-B22DF3C58D78\GoToOpener.msi" /q /lvx "C:\Users\admin\AppData\Local\Temp\LogMeInLogs\GoToOpenerMsi\4B2D0B7E-C57A-46AA-825A-F5E8752658F7.log"C:\Windows\SysWOW64\msiexec.exe—GoTo Webinar Opener.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3572C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3732"C:\Users\admin\AppData\Local\Temp\2CF9EED3-96DB-43C6-B692-33D52E96264C\G2MInstaller.exe" "/Action Join" "/BrokerServiceSuffix @ISL1" "/DidInstall True" "/EGWAddress 23.239.230.255" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 8200,80,443" "/MeetingID 389471699" "/Mode Terse" "/UserID 7878410280003531094" "/UserRole panelist" "/betaEnabled true" "/buildNumber 19992" "/colClientUiReadyEvent Global\59F02CC5-47E0-4F60-80FF-40B879A0FFB0" -delself "/locale en_US" "/productName g2m" "/sessionTrackingId e0-dzE2NxYOgvBVBgTpwYJSHh7S4Hial" "/theme g2w"C:\Users\admin\AppData\Local\Temp\2CF9EED3-96DB-43C6-B692-33D52E96264C\G2MInstaller.exe
G2MCoreInstExtractor.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
10.20.0 Build 19992
Modules
Images
c:\users\admin\appdata\local\temp\2cf9eed3-96db-43c6-b692-33d52e96264c\g2minstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3872"C:\Users\admin\AppData\Local\Temp\2CF9EED3-96DB-43C6-B692-33D52E96264C\G2MCoreInstExtractor.exe" "/Action Join" "/BrokerServiceSuffix @ISL1" "/EGWAddress 23.239.230.255" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 8200,80,443" "/MeetingID 389471699" "/Mode Terse" "/UserID 7878410280003531094" "/UserRole panelist" "/betaEnabled true" "/buildNumber 19992" "/colClientUiReadyEvent Global\59F02CC5-47E0-4F60-80FF-40B879A0FFB0" "/locale en_US" "/productName g2m" "/sessionTrackingId e0-dzE2NxYOgvBVBgTpwYJSHh7S4Hial" "/theme g2w"C:\Users\admin\AppData\Local\Temp\2CF9EED3-96DB-43C6-B692-33D52E96264C\G2MCoreInstExtractor.exe
GoTo Webinar Opener.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting Installer Extractor
Exit code:
0
Version:
10.20.0 Build 19992
Modules
Images
c:\users\admin\appdata\local\temp\2cf9eed3-96db-43c6-b692-33d52e96264c\g2mcoreinstextractor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4544C:\WINDOWS\system32\regsvr32.exe -s "C:\Users\admin\AppData\Local\GoToMeeting\19992\G2MOutlookAddin64.dll"C:\Windows\SysWOW64\regsvr32.exe—g2mlauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4580"C:\Users\admin\AppData\Local\GoToMeeting\19992\g2mlauncher.exe" "StartID={C7389F99-EBA5-4AAB-BAE5-667CB952FB20}&Debug=Off&Stat=On&StatDb=On&Index=0"C:\Users\admin\AppData\Local\GoToMeeting\19992\g2mlauncher.exe
g2mcomm.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Version:
10.20.0 Build 19992
Modules
Images
c:\users\admin\appdata\local\gotomeeting\19992\g2mlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5552"C:\Users\admin\Desktop\GoTo Webinar Opener.exe" C:\Users\admin\Desktop\GoTo Webinar Opener.exe
explorer.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoTo Opener
Exit code:
0
Version:
1.0.0.568
Modules
Images
c:\users\admin\desktop\goto webinar opener.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\comctl32.dll
5780 -s "C:\Users\admin\AppData\Local\GoToMeeting\19992\G2MOutlookAddin64.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
52 604
Read events
19 309
Write events
33 275
Delete events
20

Modification events

(PID) Process:(5552) GoTo Webinar Opener.exeKey:HKEY_CURRENT_USER\SOFTWARE\LogMeInInc\GoTo Opener
Operation:writeName:UUID
Value:
{9035D934-AD03-4E7D-9283-25E81CCFF2A2}
(PID) Process:(5552) GoTo Webinar Opener.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5552) GoTo Webinar Opener.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5552) GoTo Webinar Opener.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3572) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\A0715114F7F8F52568A2AC1CA8E3C38E
Operation:writeName:3CB80D98FF9FC0841B27AAE16334EC06
Value:
01:\Software\Classes\gotoopener568\Shell\Open\Command\
(PID) Process:(3572) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E401CFB7B09C93E5CBD61659A057E52D
Operation:writeName:3CB80D98FF9FC0841B27AAE16334EC06
Value:
01:\Software\Classes\citrixonline568\
(PID) Process:(3572) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\7BB98D29EE5359452B1FA7ACD19AB783
Operation:writeName:3CB80D98FF9FC0841B27AAE16334EC06
Value:
01:\Software\Classes\citrixonline568\Shell\Open\Command\
(PID) Process:(3572) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\3AB4F8373595A6D5587C7E13342E282D
Operation:writeName:3CB80D98FF9FC0841B27AAE16334EC06
Value:
01:\Software\Classes\.gotoopener\
(PID) Process:(3572) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\2831B0B4FEFDEA45B854E1A543121874
Operation:writeName:3CB80D98FF9FC0841B27AAE16334EC06
Value:
01:\Software\Classes\.citrixonline\
(PID) Process:(3572) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\25999881EC04C1A59A42888AD1BB43C9
Operation:writeName:3CB80D98FF9FC0841B27AAE16334EC06
Value:
01:\Software\Classes\LogMeInInc.GoToOpener\
Executable files
54
Suspicious files
19
Text files
8
Unknown types
15

Dropped files

PID
Process
Filename
Type
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419der
MD5:19B384319B5F53412CD6F466A175B7D2
SHA256:D4057D2B8F9B2E13CC3BAFDBF5692B3B47F4CAD0BA80347600EAF2F304F81C32
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:E82AC61E8A3AA00B68E0785D2AAA41BC
SHA256:934FF9FA074CC64B9378F7B096A408127857FF12E8116696E219DF03E274965C
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_1B54186EB77F9744A81BB700FA0D33B8der
MD5:6D46B6705ED98F26186113E4E888B31E
SHA256:3D3714E6DA61EB24AC000185A49F1D7A1CE4DA9A464198B510386B994572FA47
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656der
MD5:56553703953BB8ADE0A897F14AD0662D
SHA256:50A5DB12E0F3C9683F0513AA1F0E60675CA459E6F60D13E2BA9414F1325911CC
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_1B54186EB77F9744A81BB700FA0D33B8binary
MD5:3EF803E8302F96A715D145B701E7E114
SHA256:5D011E5942B510F115E5EDAF5C5F0D68820B28B5F99C4C7238E154A4C75D3D50
3572msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:DAF5069AF51CDAC65D5215D0C4E37D35
SHA256:14B819B82CFBDF686B32872DE02C733F7F716E62EF7577D3340CFA41770A5DE1
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656binary
MD5:74982BD5A815EB95016316B0832D9BC9
SHA256:0FC6C7E006FC2A38C3DA74DB6EDF7E01357F84F6A0C503CC9FA70E7D89745013
3572msiexec.exeC:\Windows\Installer\18ce67.msiexecutable
MD5:6C4E312D5ABA85A471FA535039B75C11
SHA256:0F22CB5D0AB323DD23DDB6DBB7495569744452D6E2C3892F216335E083F2825F
3572msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:841BBDF498EDF3BF4F564BD6C3967981
SHA256:329FF88BF60EB7F8D5C477A229F8491B97EBE9D008AC090DEF6A9B6C4DDFD3D3
5552GoTo Webinar Opener.exeC:\Users\admin\AppData\Local\Temp\994AC69D-1F1B-4EFE-9530-B22DF3C58D78\GoTo Opener.exeexecutable
MD5:D28494052AC3206DDB3E6A1D0AE4C186
SHA256:1946F1AF5A374CC1F1935DEFF5EB9AB611921A4F64FCEEAA1430E929E1015EB4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
42
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5552
GoTo Webinar Opener.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
—
—
whitelisted
5552
GoTo Webinar Opener.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAFQbYykKS5BkKBW3vL1Abo%3D
unknown
—
—
whitelisted
3572
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
3572
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
3572
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAjegkJ27mLaGBP72%2FEoqPs%3D
unknown
—
—
whitelisted
7104
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5552
GoTo Webinar Opener.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
18.173.208.27:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEANH78g8GxK2GnXaa%2F9XM84%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2596
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5552
GoTo Webinar Opener.exe
23.239.230.239:443
launch.getgo.com
ORACLE-BMC-31898
US
whitelisted
5552
GoTo Webinar Opener.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5552
GoTo Webinar Opener.exe
3.160.150.63:443
builds.cdn.getgo.com
—
US
shared
5552
GoTo Webinar Opener.exe
18.245.38.41:80
ocsp.rootca1.amazontrust.com
—
US
whitelisted
3572
msiexec.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
launch.getgo.com
  • 23.239.230.239
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
builds.cdn.getgo.com
  • 3.160.150.63
  • 3.160.150.24
  • 3.160.150.106
  • 3.160.150.118
shared
ocsp.rootca1.amazontrust.com
  • 18.245.38.41
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.131
  • 40.126.32.68
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.3
  • 20.190.160.64
  • 40.126.32.72
whitelisted
egwglobal.gotomeeting.com
  • 23.239.230.255
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

No threats detected
Process
Message
GoTo Webinar Opener.exe
setSafeDllSearchPath()
GoTo Webinar Opener.exe
preLoadDllsFromSystem()
GoTo Webinar Opener.exe
C:\WINDOWS\system32\MSVCRT.DLL
GoTo Webinar Opener.exe
GoTo Webinar Opener.exe
C:\WINDOWS\system32\BCRYPTPRIMITIVES.DLL
GoTo Webinar Opener.exe
GoTo Webinar Opener.exe
C:\WINDOWS\system32\CRYPTBASE.DLL
GoTo Webinar Opener.exe
GoTo Webinar Opener.exe
C:\WINDOWS\system32\SECUR32.DLL
GoTo Webinar Opener.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GoTo Webinar Opener.exe