File name:

GoToMeeting Opener.exe

Full analysis: https://app.any.run/tasks/41cb917b-4d5d-4d13-9744-c5b8726d7f64
Verdict: Malicious activity
Analysis date: August 28, 2018, 12:45:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

4C7131ED2CFD27E5CC3BC656DA37F26A

SHA1:

9B16CE7FF29DE949A394F595656CA2AD016BF837

SHA256:

C6332AF983E6A2790C41DA9626F09CDE0B9263729622C85E777C45F8A42752BA

SSDEEP:

6144:ZEnyXJHn49qPfZtHL01xEV/TpjkbSJbYjphzPyCl2NZ6oS7w6BLydL8A4++s++jK:ZeyqqtxVFIG9YjLzPyW236oS7wAe98NB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • G2MCoreInstExtractor.exe (PID: 2804)
      • G2MInstaller.exe (PID: 4048)
      • G2MInstaller.exe (PID: 3360)
      • g2mstart.exe (PID: 2552)
      • g2mlauncher.exe (PID: 3156)
      • g2mcomm.exe (PID: 3516)

    • Loads dropped or rewritten executable

      • g2mlauncher.exe (PID: 3156)
      • rundll32.exe (PID: 3448)

    • Registers / Runs the DLL via REGSVR32.EXE

      • g2mlauncher.exe (PID: 3156)

    • Loads the Task Scheduler DLL interface

      • G2MInstaller.exe (PID: 4048)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • GoToMeeting Opener.exe (PID: 3736)
      • msiexec.exe (PID: 640)
      • G2MCoreInstExtractor.exe (PID: 2804)
      • G2MInstaller.exe (PID: 4048)

    • Creates files in the user directory

      • msiexec.exe (PID: 640)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 640)
      • G2MInstaller.exe (PID: 4048)

    • Starts Microsoft Installer

      • GoToMeeting Opener.exe (PID: 3736)

    • Creates a software uninstall entry

      • G2MInstaller.exe (PID: 4048)

    • Starts itself from another location

      • G2MInstaller.exe (PID: 4048)

    • Creates COM task schedule object

      • g2mlauncher.exe (PID: 3156)

    • Reads Internet Cache Settings

      • g2mcomm.exe (PID: 3516)

    • Connects to unusual port

      • g2mcomm.exe (PID: 3516)

    • Starts CMD.EXE for commands execution

      • GoToMeeting Opener.exe (PID: 3736)

    • Creates files in the Windows directory

      • G2MInstaller.exe (PID: 4048)

  • INFO

    • Dropped object may contain URL's

      • GoToMeeting Opener.exe (PID: 3736)
      • msiexec.exe (PID: 640)
      • msiexec.exe (PID: 2248)
      • G2MCoreInstExtractor.exe (PID: 2804)
      • G2MInstaller.exe (PID: 4048)

    • Reads settings of System Certificates

      • GoToMeeting Opener.exe (PID: 3736)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:26 22:01:07+02:00
PEType: PE32
LinkerVersion: 12
CodeSize: 221184
InitializedDataSize: 69632
UninitializedDataSize: 602112
EntryPoint: 0xc8dc0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.481
ProductVersionNumber: 1.0.0.481
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: LogMeIn, Inc.
LegalCopyright: Copyright © 2012-2018 LogMeIn, Inc.
ProductName: GoTo Opener
FileDescription: GoTo Opener
InternalName: GoToOpener
OriginalFileName: GoToOpener.exe
FileVersion: 1.0.0.481
ProductVersion: 1.0.0.481

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 26-Jun-2018 20:01:07
Detected languages:
  • Chinese - Taiwan
  • Czech - Czech Republic
  • English - United States
  • Polish - Poland
  • Russian - Russia
  • Turkish - Turkey
CompanyName: LogMeIn, Inc.
LegalCopyright: Copyright © 2012-2018 LogMeIn, Inc.
ProductName: GoTo Opener
FileDescription: GoTo Opener
InternalName: GoToOpener
OriginalFilename: GoToOpener.exe
FileVersion: 1.0.0.481
ProductVersion: 1.0.0.481

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 26-Jun-2018 20:01:07
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00093000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00094000
0x00036000
0x00035A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99785
.rsrc
0x000CA000
0x00011000
0x00011000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.84609

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07844
1318
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.83509
744
Latin 1 / Western European
UNKNOWN
RT_ICON
3
3.72476
296
Latin 1 / Western European
UNKNOWN
RT_ICON
4
4.94788
3752
Latin 1 / Western European
UNKNOWN
RT_ICON
5
5.01628
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
6
4.26294
1384
Latin 1 / Western European
UNKNOWN
RT_ICON
7
7.97457
36411
Latin 1 / Western European
UNKNOWN
RT_ICON
8
4.14254
9640
Latin 1 / Western European
UNKNOWN
RT_ICON
9
4.08107
4264
Latin 1 / Western European
UNKNOWN
RT_ICON
10
5.49055
1128
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

KERNEL32.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
12
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start gotomeeting opener.exe msiexec.exe no specs msiexec.exe g2mcoreinstextractor.exe g2minstaller.exe g2minstaller.exe no specs g2mstart.exe no specs rundll32.exe no specs g2mcomm.exe g2mlauncher.exe no specs regsvr32.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2248"C:\Windows\system32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\22C9AA73-B6B0-4D4C-A579-B2BE2B9B2717\GoToOpener.msi" /q /lvx "C:\Users\admin\AppData\Local\Temp\LogMeInLogs\GoToOpenerMsi\91572FD2-4E21-475A-B3A5-C5EDEFA5A827.log"C:\Windows\system32\msiexec.exe—GoToMeeting Opener.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2552"C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mstart.exe" "/Action Join" "/Download Auto" "/EGWAddress 216.115.208.230" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 80,443,8200" "/MeetingID 594935493" "/Mode Terse" "/Product g2m" "/brokerServiceSuffix @ISL1" "/colClientUiReadyEvent Global\1478FC6E-7CFA-4B07-9D48-182F8AC0BF0D" "/sessionTrackingId ul-792e-bd91-4fe2-c3d6c38a7c50"C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mstart.exe—G2MInstaller.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
8.33.0 Build 9250
Modules
Images
c:\users\admin\appdata\local\gotomeeting\9250\g2mstart.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\9250\g2m.dll
2804"C:\Users\admin\AppData\Local\Temp\4EDE38B4-8B86-42B1-815E-37B3AD2D25E2\G2MCoreInstExtractor.exe" "/Action Join" "/EGWAddress 216.115.208.230" "/EGWDNS egwglobal.gotomeeting.com" "/EGWPort 80,443,8200" "/MeetingID 594935493" "/Mode Terse" "/Product g2m" "/brokerServiceSuffix @ISL1" "/colClientUiReadyEvent Global\1478FC6E-7CFA-4B07-9D48-182F8AC0BF0D" "/sessionTrackingId ul-792e-bd91-4fe2-c3d6c38a7c50"C:\Users\admin\AppData\Local\Temp\4EDE38B4-8B86-42B1-815E-37B3AD2D25E2\G2MCoreInstExtractor.exe
GoToMeeting Opener.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting Installer Extractor
Exit code:
0
Version:
8.33.0 Build 9250
Modules
Images
c:\users\admin\appdata\local\temp\4ede38b4-8b86-42b1-815e-37b3ad2d25e2\g2mcoreinstextractor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3156"C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mlauncher.exe" "StartID={BC0E1067-38CB-4AE1-8EE7-7E55D45A06DF}&Debug=Off&Stat=On&StatDb=On&Index=0"C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mlauncher.exe—g2mcomm.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
8.33.0 Build 9250
Modules
Images
c:\users\admin\appdata\local\gotomeeting\9250\g2mlauncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\9250\g2m.dll
3360"C:\Users\admin\AppData\Local\GoToMeeting\9250\G2MInstaller.exe" -noopC:\Users\admin\AppData\Local\GoToMeeting\9250\G2MInstaller.exe—G2MInstaller.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
8.33.0 Build 9250
Modules
Images
c:\users\admin\appdata\local\gotomeeting\9250\g2minstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\9250\g2m.dll
3448rundll32.exe "C:\Users\admin\AppData\Local\Temp\4EDE38B4-8B86-42B1-815E-37B3AD2D25E2\uninshlp.dll",DeleteExeAndDeleteSelf 4b08e5a8-e813-42c2-afb5-7ccd8e04675bC:\Windows\system32\rundll32.exe—G2MInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3516"C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mcomm.exe" "Action=Join&brokerServiceSuffix=@ISL1&colClientUiReadyEvent=Global\1478FC6E-7CFA-4B07-9D48-182F8AC0BF0D&Digest=a5f512d08ebfafc2207be4698ccb1e33&Dir=C:\Users\admin\AppData\Local\GoToMeeting\9250\&Download=Auto&EGWAddress=216.115.208.230&EGWDNS=egwglobal.gotomeeting.com&EGWPort=80,443,8200&LoaderPath=C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mstart.exe&LogName=c:\users\admin\appdata\local\temp\logmeinlogs\gotomeeting\9250\2018-08-28_13.45.50.636\GoToMeeting.log&MeetingID=594935493&Mode=Terse&Path=g2mlauncher.exe&Plugin=G2MLauncher&Product=g2m&sessionTrackingId=ul-792e-bd91-4fe2-c3d6c38a7c50&UniqueId=9f8"C:\Users\admin\AppData\Local\GoToMeeting\9250\g2mcomm.exe
g2mstart.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoToMeeting
Exit code:
0
Version:
8.33.0 Build 9250
Modules
Images
c:\users\admin\appdata\local\gotomeeting\9250\g2mcomm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\gotomeeting\9250\g2m.dll
3736"C:\Users\admin\AppData\Local\Temp\GoToMeeting Opener.exe" C:\Users\admin\AppData\Local\Temp\GoToMeeting Opener.exe
explorer.exe
User:
admin
Company:
LogMeIn, Inc.
Integrity Level:
MEDIUM
Description:
GoTo Opener
Exit code:
0
Version:
1.0.0.481
Modules
Images
c:\users\admin\appdata\local\temp\gotomeeting opener.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3864cmd /c ""C:\Users\admin\AppData\Local\Temp\D774EE3A-5485-4439-9B41-03312B9462BC.bat" "C:\Users\admin\AppData\Local\Temp\GoToMeeting Opener.exe""C:\Windows\system32\cmd.exe—GoToMeeting Opener.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 006
Read events
1 636
Write events
356
Delete events
14

Modification events

(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3736) GoToMeeting Opener.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GoToMeeting Opener_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
59
Suspicious files
10
Text files
8
Unknown types
3

Dropped files

PID
Process
Filename
Type
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHUAAB7W\GoToOpener[1].msi —
MD5:—
SHA256:—
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\Cab65EC.tmp —
MD5:—
SHA256:—
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\Tar65FC.tmp —
MD5:—
SHA256:—
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\Cab660D.tmp —
MD5:—
SHA256:—
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\Tar660E.tmp —
MD5:—
SHA256:—
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\Cab66AB.tmp —
MD5:—
SHA256:—
3736GoToMeeting Opener.exeC:\Users\admin\AppData\Local\Temp\Tar66AC.tmp —
MD5:—
SHA256:—
640msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF23FD5BC4DEBD7292.TMP —
MD5:—
SHA256:—
640msiexec.exeC:\Config.Msi\4c65cf.rbs —
MD5:—
SHA256:—
640msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF67498A23A12C7F11.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
16
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3516
g2mcomm.exe
CONNECT
—
216.115.208.230:80
http://216.115.208.230:443
US
—
—
suspicious
3516
g2mcomm.exe
CONNECT
—
216.115.208.230:80
http://216.115.208.230:443
US
—
—
suspicious
3736
GoToMeeting Opener.exe
GET
200
54.230.95.29:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
3736
GoToMeeting Opener.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
52.8 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3736
GoToMeeting Opener.exe
78.108.120.31:443
launch.getgo.com
Mobility Apps division
—
unknown
3736
GoToMeeting Opener.exe
54.230.93.59:443
builds.cdn.getgo.com
Amazon.com, Inc.
US
unknown
3736
GoToMeeting Opener.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3516
g2mcomm.exe
54.230.93.59:443
builds.cdn.getgo.com
Amazon.com, Inc.
US
unknown
3516
g2mcomm.exe
216.115.208.230:443
egwglobal.gotomeeting.com
Mobility Apps division
US
suspicious
3736
GoToMeeting Opener.exe
54.230.95.29:80
x.ss2.us
Amazon.com, Inc.
US
unknown
3516
g2mcomm.exe
216.115.208.230:8200
egwglobal.gotomeeting.com
Mobility Apps division
US
suspicious
3516
g2mcomm.exe
216.115.208.230:80
egwglobal.gotomeeting.com
Mobility Apps division
US
suspicious
3516
g2mcomm.exe
68.64.14.192:443
global.gotomeeting.com
Mobility Apps division
US
unknown

DNS requests

Domain
IP
Reputation
launch.getgo.com
  • 78.108.120.31
whitelisted
builds.cdn.getgo.com
  • 54.230.93.59
  • 54.230.93.183
  • 54.230.93.244
  • 54.230.93.22
shared
x.ss2.us
  • 54.230.95.29
  • 54.230.95.200
  • 54.230.95.216
  • 54.230.95.118
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
egwglobal.gotomeeting.com
  • 216.115.208.230
whitelisted
global.gotomeeting.com
  • 68.64.14.192
whitelisted

Threats

No threats detected
Process
Message
GoToMeeting Opener.exe
preLoadDllsFromSystem()
GoToMeeting Opener.exe
preLoadDllsFromSystem()
GoToMeeting Opener.exe
C:\Windows\system32\MSVCRT.DLL
GoToMeeting Opener.exe
GoToMeeting Opener.exe
GoToMeeting Opener.exe
GoToMeeting Opener.exe
C:\Windows\system32\CRYPTBASE.DLL
GoToMeeting Opener.exe
GoToMeeting Opener.exe
GoToMeeting Opener.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GoToMeeting Opener.exe