File name:

TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe

Full analysis: https://app.any.run/tasks/060a846f-7a02-4dab-93ab-94c76eb0a0af
Verdict: Malicious activity
Analysis date: December 22, 2023, 04:35:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

58B05149E1BA3AE4BFE8181A2B5C958B

SHA1:

118D2ADC33D7D3853DA15E8C1E68E66A00822231

SHA256:

E51FB228BD5C2649EBE0A359DE308EC2A8A21C38A008CCCC81008DB382C329BD

SSDEEP:

98304:BLbkHLWqniKHqvsfK/nHPqH5lTy0wi28oqExu2xN2LjaHDXrPRRljmeB5rb60c2c:toPGHq40xn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2584)
      • net.exe (PID: 2396)

  • SUSPICIOUS

    • Searches for installed software

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • The process creates files with name similar to system file names

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)

    • Reads the Internet Settings

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)

    • Reads the Windows owner or organization settings

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Checks Windows Trust Settings

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Reads security settings of Internet Explorer

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Adds/modifies Windows certificates

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Reads settings of System Certificates

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2468)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 2028)

    • Creates a software uninstall entry

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

  • INFO

    • Checks supported languages

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 128)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Reads the machine GUID from the registry

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1780)

    • Create files in a temporary directory

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 128)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Starts itself from another location

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)

    • Reads the computer name

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Drops the executable file immediately after the start

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 128)
      • msiexec.exe (PID: 2028)

    • Creates files in the program directory

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:17 07:33:38+02:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 299008
InitializedDataSize: 186880
UninitializedDataSize: -
EntryPoint: 0x2df71
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 42.1.15.0
ProductVersionNumber: 42.1.15.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: TeamMate, a Wolters Kluwer company
FileDescription: TeamMate Advanced Integration (3264) September 2023 Update 1
FileVersion: 42.1.15.0
InternalName: setup
LegalCopyright: Copyright (c) 2023 TeamMate Licensing B.V. All rights reserved.
OriginalFileName: OfficeAddIn.Setup3264.Bootstrapper_x32.exe
ProductName: TeamMate Advanced Integration (3264) September 2023 Update 1
ProductVersion: 42.1.15.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe no specs teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe no specs officeaddin.setup3264.bootstrapper_x32.exe vssvc.exe no specs msiexec.exe no specs cmd.exe no specs sc.exe cmd.exe no specs net.exe net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe" C:\Users\admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe—explorer.exe
User:
admin
Company:
TeamMate, a Wolters Kluwer company
Integrity Level:
MEDIUM
Description:
TeamMate Advanced Integration (3264) September 2023 Update 1
Exit code:
0
Version:
42.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1072"C:\Users\admin\AppData\Local\Temp\{256BBD72-B38E-4A02-8DBF-9E627329732D}\.cr\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe" -burn.filehandle.attached=152 -burn.filehandle.self=160 C:\Users\admin\AppData\Local\Temp\{256BBD72-B38E-4A02-8DBF-9E627329732D}\.cr\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe—TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe
User:
admin
Company:
TeamMate, a Wolters Kluwer company
Integrity Level:
MEDIUM
Description:
TeamMate Advanced Integration (3264) September 2023 Update 1
Exit code:
0
Version:
42.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\{256bbd72-b38e-4a02-8dbf-9e627329732d}\.cr\teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1504"C:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.be\OfficeAddIn.Setup3264.Bootstrapper_x32.exe" -q -burn.elevated BurnPipe.{B59E300D-94C0-4C22-9F64-3A6F4D633B1C} {FEE73889-8D6E-4B35-9FA5-B6CD7B9E52F1} 1072C:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.be\OfficeAddIn.Setup3264.Bootstrapper_x32.exe
TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe
User:
admin
Company:
TeamMate, a Wolters Kluwer company
Integrity Level:
HIGH
Description:
TeamMate Advanced Integration (3264) September 2023 Update 1
Exit code:
0
Version:
42.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\{6bcf5ceb-b270-477f-8d33-3f7aebd6b5fd}\.be\officeaddin.setup3264.bootstrapper_x32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1600sc config webclient start=autoC:\Windows\System32\sc.exe
cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1639
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1780C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2028C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2396net start webclientC:\Windows\System32\net.exe
cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2468cmd.exe /c "sc config webclient start=auto"C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1639
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2584cmd.exe /c "net start webclient"C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2808C:\Windows\system32\net1 start webclientC:\Windows\System32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
Total events
10 808
Read events
10 744
Write events
52
Delete events
12

Modification events

(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
73
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008543C5D72FB0D90164030000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
4000000000000000D1ABF1D82FB0D90164030000840D0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
66
Suspicious files
12
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
128TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{256BBD72-B38E-4A02-8DBF-9E627329732D}\.cr\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeexecutable
MD5:CDD9AF677DEB995E370C80A466D0E3BB
SHA256:B54C5CC5BD8F56E8C057523BA527ADA988F281AABEC891F7991BB41B3E771F51
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1028\mbapreq.wxlxml
MD5:1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA256:1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1030\mbapreq.wxlxml
MD5:7C6E4CE87870B3B5E71D3EF4555500F8
SHA256:CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbapreq.pngimage
MD5:A356956FD269567B8F4612A33802637B
SHA256:A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbahost.dllexecutable
MD5:C59832217903CE88793A6C40888E3CAE
SHA256:9DFA1BC5D2AB4C652304976978749141B8C312784B05CB577F338A0AA91330DB
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbapreq.dllexecutable
MD5:FE7E0BD53F52E6630473C31299A49FDD
SHA256:2BEA14D70943A42D344E09B7C9DE5562FA7E109946E1C615DD584DA30D06CC80
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbapreq.thmxml
MD5:4D9386E0154D2A3607D77241C36292CC
SHA256:141749F1752331E90E30B1421953776DDB75DF29A6164D048A08ED3E7B772C7C
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\eula.rtftext
MD5:85BED13090AF7404DBFCCAC7DFFA96DB
SHA256:5B757D784DAA37607832999EDFB496F59AC0637C3CE36AB0FB98144C98673C67
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1029\mbapreq.wxlxml
MD5:CC8C6D04DC707B38E0F0C08BA16FE49B
SHA256:DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\BootstrapperCore.dllexecutable
MD5:1197872FA5DBF0A9D8C742558812DDE8
SHA256:C1232F304EC8B3CE1626569AC28C6D1EEEA2EB891FC52D39E56F0D6102AC3D7E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe