File name:

TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe

Full analysis: https://app.any.run/tasks/060a846f-7a02-4dab-93ab-94c76eb0a0af
Verdict: Malicious activity
Analysis date: December 22, 2023, 04:35:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

58B05149E1BA3AE4BFE8181A2B5C958B

SHA1:

118D2ADC33D7D3853DA15E8C1E68E66A00822231

SHA256:

E51FB228BD5C2649EBE0A359DE308EC2A8A21C38A008CCCC81008DB382C329BD

SSDEEP:

98304:BLbkHLWqniKHqvsfK/nHPqH5lTy0wi28oqExu2xN2LjaHDXrPRRljmeB5rb60c2c:toPGHq40xn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 2396)
      • cmd.exe (PID: 2584)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)

    • Searches for installed software

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Reads the Internet Settings

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)

    • Checks Windows Trust Settings

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Reads security settings of Internet Explorer

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Adds/modifies Windows certificates

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Reads settings of System Certificates

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Reads the Windows owner or organization settings

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Creates a software uninstall entry

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2468)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 2028)

  • INFO

    • Create files in a temporary directory

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 128)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Checks supported languages

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 128)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Drops the executable file immediately after the start

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)
      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 128)

    • Reads the machine GUID from the registry

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Reads the computer name

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)
      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)
      • msiexec.exe (PID: 2028)

    • Starts itself from another location

      • TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe (PID: 1072)

    • Creates files in the program directory

      • OfficeAddIn.Setup3264.Bootstrapper_x32.exe (PID: 1504)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1780)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:17 07:33:38+02:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 299008
InitializedDataSize: 186880
UninitializedDataSize: -
EntryPoint: 0x2df71
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 42.1.15.0
ProductVersionNumber: 42.1.15.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: TeamMate, a Wolters Kluwer company
FileDescription: TeamMate Advanced Integration (3264) September 2023 Update 1
FileVersion: 42.1.15.0
InternalName: setup
LegalCopyright: Copyright (c) 2023 TeamMate Licensing B.V. All rights reserved.
OriginalFileName: OfficeAddIn.Setup3264.Bootstrapper_x32.exe
ProductName: TeamMate Advanced Integration (3264) September 2023 Update 1
ProductVersion: 42.1.15.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe no specs teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe no specs officeaddin.setup3264.bootstrapper_x32.exe vssvc.exe no specs msiexec.exe no specs cmd.exe no specs sc.exe cmd.exe no specs net.exe net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe" C:\Users\admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe—explorer.exe
User:
admin
Company:
TeamMate, a Wolters Kluwer company
Integrity Level:
MEDIUM
Description:
TeamMate Advanced Integration (3264) September 2023 Update 1
Exit code:
0
Version:
42.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1072"C:\Users\admin\AppData\Local\Temp\{256BBD72-B38E-4A02-8DBF-9E627329732D}\.cr\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe" -burn.filehandle.attached=152 -burn.filehandle.self=160 C:\Users\admin\AppData\Local\Temp\{256BBD72-B38E-4A02-8DBF-9E627329732D}\.cr\TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe—TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe
User:
admin
Company:
TeamMate, a Wolters Kluwer company
Integrity Level:
MEDIUM
Description:
TeamMate Advanced Integration (3264) September 2023 Update 1
Exit code:
0
Version:
42.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\{256bbd72-b38e-4a02-8dbf-9e627329732d}\.cr\teammate_advanced_integration_3264_september_2023_update_1_,jssl.teammatehosting.com,.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1504"C:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.be\OfficeAddIn.Setup3264.Bootstrapper_x32.exe" -q -burn.elevated BurnPipe.{B59E300D-94C0-4C22-9F64-3A6F4D633B1C} {FEE73889-8D6E-4B35-9FA5-B6CD7B9E52F1} 1072C:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.be\OfficeAddIn.Setup3264.Bootstrapper_x32.exe
TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe
User:
admin
Company:
TeamMate, a Wolters Kluwer company
Integrity Level:
HIGH
Description:
TeamMate Advanced Integration (3264) September 2023 Update 1
Exit code:
0
Version:
42.1.15.0
Modules
Images
c:\users\admin\appdata\local\temp\{6bcf5ceb-b270-477f-8d33-3f7aebd6b5fd}\.be\officeaddin.setup3264.bootstrapper_x32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1600sc config webclient start=autoC:\Windows\System32\sc.exe
cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1639
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1780C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2028C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2396net start webclientC:\Windows\System32\net.exe
cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2468cmd.exe /c "sc config webclient start=auto"C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1639
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2584cmd.exe /c "net start webclient"C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2808C:\Windows\system32\net1 start webclientC:\Windows\System32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
Total events
10 808
Read events
10 744
Write events
52
Delete events
12

Modification events

(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1072) TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
73
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008543C5D72FB0D90164030000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1504) OfficeAddIn.Setup3264.Bootstrapper_x32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
4000000000000000D1ABF1D82FB0D90164030000840D0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
66
Suspicious files
12
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbahost.dllexecutable
MD5:C59832217903CE88793A6C40888E3CAE
SHA256:9DFA1BC5D2AB4C652304976978749141B8C312784B05CB577F338A0AA91330DB
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1030\mbapreq.wxlxml
MD5:7C6E4CE87870B3B5E71D3EF4555500F8
SHA256:CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1029\mbapreq.wxlxml
MD5:CC8C6D04DC707B38E0F0C08BA16FE49B
SHA256:DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\TeamMate.Setup.ManagedBootstrapper.dllexecutable
MD5:890270796C0F14FCEBC130DA9471ABB4
SHA256:98FB7562CF718295450C7003B92ED365FE3923423A3D9FE82617F190223CEFE0
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbapreq.pngimage
MD5:A356956FD269567B8F4612A33802637B
SHA256:A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1031\mbapreq.wxlxml
MD5:C8E7E0B4E63B3076047B7F49C76D56E1
SHA256:631D46CB048FB6CF0B9A1362F8E5A1854C46E9525A0260C7841A04B2316C8295
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\eula.rtftext
MD5:85BED13090AF7404DBFCCAC7DFFA96DB
SHA256:5B757D784DAA37607832999EDFB496F59AC0637C3CE36AB0FB98144C98673C67
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\mbapreq.thmxml
MD5:4D9386E0154D2A3607D77241C36292CC
SHA256:141749F1752331E90E30B1421953776DDB75DF29A6164D048A08ED3E7B772C7C
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1032\mbapreq.wxlxml
MD5:074D5921AF07E6126049CB45814246ED
SHA256:B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
1072TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exeC:\Users\admin\AppData\Local\Temp\{6BCF5CEB-B270-477F-8D33-3F7AEBD6B5FD}\.ba\1038\mbapreq.wxlxml
MD5:17FB605A2F02DA203DF06F714D1CC6DE
SHA256:55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TeamMate_Advanced_Integration_3264_September_2023_Update_1_,jssl.teammatehosting.com,.exe