File name:

cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe

Full analysis: https://app.any.run/tasks/1efd66b2-f968-40c3-bcb0-693c9c58701f
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: January 29, 2025, 21:08:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
unwanted
netsupport
delphi
tool
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

C50FD06F02EDB960ECCB1FA95574A2A8

SHA1:

A152464E017A557A2514E4A928BE0AAECDD3AC23

SHA256:

78E1E350AA5525669F85E6972150B679D489A3787B6522F278AB40EA978DD65D

SSDEEP:

196608:GKAczKQppW//xE1BZLgThZb7zhwOaBDbiuyTXJqzv3:VzvW//8ohpfh9U3yTM3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NETSUPPORT mutex has been found

      • client32.exe (PID: 1596)

    • Connects to the CnC server

      • client32.exe (PID: 1596)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 2612)
      • vpnagent.exe (PID: 6540)

    • NETSUPPORT has been detected (YARA)

      • client32.exe (PID: 1596)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5872)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5728)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • drvinst.exe (PID: 6288)
      • drvinst.exe (PID: 6376)

    • Reads security settings of Internet Explorer

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 3076)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • client32.exe (PID: 1596)
      • InstallHelper.exe (PID: 6456)
      • vpnagent.exe (PID: 6540)
      • csc_ui.exe (PID: 6712)

    • Reads the Windows owner or organization settings

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)

    • Drop NetSupport executable file

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)

    • The process drops C-runtime libraries

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • msiexec.exe (PID: 3364)

    • Process drops legitimate windows executable

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • msiexec.exe (PID: 3364)

    • Uses ICACLS.EXE to modify access control lists

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3364)
      • drvinst.exe (PID: 6288)
      • vpnagent.exe (PID: 6540)
      • csc_ui.exe (PID: 6712)

    • Executes application which crashes

      • msiexec.exe (PID: 3836)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 2612)
      • drvinst.exe (PID: 6288)
      • drvinst.exe (PID: 6376)

    • Potential Corporate Privacy Violation

      • client32.exe (PID: 1596)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 3364)

    • Creates/Modifies COM task schedule object

      • InstallHelper.exe (PID: 3208)

    • Creates files in the driver directory

      • msiexec.exe (PID: 2612)
      • drvinst.exe (PID: 6288)
      • VACon64.exe (PID: 6216)
      • drvinst.exe (PID: 6376)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 6376)

    • Executes as Windows Service

      • vpnagent.exe (PID: 6540)

    • There is functionality for taking screenshot (YARA)

      • csc_ui.exe (PID: 6712)

    • Reads Internet Explorer settings

      • csc_ui.exe (PID: 6712)

  • INFO

    • Create files in a temporary directory

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5872)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5728)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • csc_ui.exe (PID: 6712)

    • Checks supported languages

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5872)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 3076)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5728)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • client32.exe (PID: 1596)
      • msiexec.exe (PID: 4932)
      • msiexec.exe (PID: 3364)
      • InstallHelper.exe (PID: 5892)
      • InstallHelper.exe (PID: 4504)
      • msiexec.exe (PID: 3836)
      • msiexec.exe (PID: 4716)
      • InstallHelper.exe (PID: 3208)
      • InstallHelper.exe (PID: 396)
      • msiexec.exe (PID: 2612)
      • InstallHelper.exe (PID: 4504)
      • VACon64.exe (PID: 6216)
      • drvinst.exe (PID: 6288)
      • drvinst.exe (PID: 6376)
      • InstallHelper.exe (PID: 6456)
      • vpnagent.exe (PID: 6540)
      • InstallHelper.exe (PID: 6516)
      • InstallHelper.exe (PID: 6488)
      • InstallHelper.exe (PID: 6652)
      • csc_ui.exe (PID: 6712)

    • Reads the computer name

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 3076)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5728)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • client32.exe (PID: 1596)
      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 4932)
      • msiexec.exe (PID: 3836)
      • InstallHelper.exe (PID: 5892)
      • InstallHelper.exe (PID: 4504)
      • InstallHelper.exe (PID: 396)
      • msiexec.exe (PID: 4716)
      • InstallHelper.exe (PID: 3208)
      • msiexec.exe (PID: 2612)
      • InstallHelper.exe (PID: 4504)
      • InstallHelper.exe (PID: 2224)
      • drvinst.exe (PID: 6376)
      • drvinst.exe (PID: 6288)
      • InstallHelper.exe (PID: 6456)
      • InstallHelper.exe (PID: 6488)
      • vpnagent.exe (PID: 6540)
      • InstallHelper.exe (PID: 6516)
      • InstallHelper.exe (PID: 6652)
      • csc_ui.exe (PID: 6712)

    • Process checks computer location settings

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 3076)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)

    • Creates files in the program directory

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • InstallHelper.exe (PID: 6456)
      • vpnagent.exe (PID: 6540)

    • The sample compiled with english language support

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 4388)
      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 2612)
      • drvinst.exe (PID: 6288)
      • drvinst.exe (PID: 6376)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3364)
      • VACon64.exe (PID: 6216)
      • drvinst.exe (PID: 6288)
      • vpnagent.exe (PID: 6540)
      • csc_ui.exe (PID: 6712)

    • Creates files or folders in the user directory

      • client32.exe (PID: 1596)
      • msiexec.exe (PID: 3364)

    • Reads the software policy settings

      • msiexec.exe (PID: 3364)
      • VACon64.exe (PID: 6216)
      • drvinst.exe (PID: 6288)
      • vpnagent.exe (PID: 6540)
      • csc_ui.exe (PID: 6712)

    • Reads Environment values

      • msiexec.exe (PID: 4932)

    • Checks proxy server information

      • client32.exe (PID: 1596)

    • Compiled with Borland Delphi (YARA)

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 3076)
      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe (PID: 5872)

    • Detects InnoSetup installer (YARA)

      • cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp (PID: 3076)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 2612)

    • Creates or modifies Windows services

      • msiexec.exe (PID: 3364)

    • Application launched itself

      • msiexec.exe (PID: 3364)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3364)

    • Reads the time zone

      • runonce.exe (PID: 3836)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:08 15:36:35+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 684032
InitializedDataSize: 371712
UninitializedDataSize: -
EntryPoint: 0xa7f98
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 2.5.4594.1
ProductVersionNumber: 2.5.4594.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Cisco Systems, Inc.
FileDescription: Cisco Systems Setup
FileVersion: 2.5.4594.1
LegalCopyright: Cisco Systems, Inc.
OriginalFileName:
ProductName: Cisco Systems
ProductVersion: 2.5.4594.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
32
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp no specs cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp #NETSUPPORT client32.exe icacls.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe werfault.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs msiexec.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs msiexec.exe runonce.exe no specs grpconv.exe no specs vacon64.exe no specs drvinst.exe drvinst.exe installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs vpnagent.exe installhelper.exe no specs csc_ui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396"C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe" -moveFiles "C:\Program Files (x86)\Cisco\Cisco Secure Client\\" "C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\\" "pluginreg_vpn_feedback.json"C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
HIGH
Description:
Install Helper
Exit code:
0
Version:
5, 0, 05040
Modules
Images
c:\program files (x86)\cisco\cisco secure client\installhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
440C:\WINDOWS\SysWOW64\WerFault.exe -u -p 3836 -s 916C:\Windows\SysWOW64\WerFault.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1596"C:\ProgramData\CiscoMedia\client32.exe" C:\ProgramData\CiscoMedia\client32.exe
cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp
User:
admin
Company:
NetSupport Ltd
Integrity Level:
HIGH
Description:
NetSupport Client Application
Version:
V14.10
Modules
Images
c:\programdata\ciscomedia\client32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\programdata\ciscomedia\pcicl32.dll
1688"icacls" "C:\ProgramData\CiscoMedia" /grant *S-1-1-0:(F) /grant Users:(F) /grant Everyone:(F) /T /CC:\Windows\SysWOW64\icacls.exe—cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2224"C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe" -moveFiles "C:\Program Files (x86)\Cisco\Cisco Secure Client\\" "C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\\" "pluginreg_vpn_webhelper.json"C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
HIGH
Description:
Install Helper
Exit code:
0
Version:
5, 0, 05040
Modules
Images
c:\program files (x86)\cisco\cisco secure client\installhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2612C:\Windows\System32\MsiExec.exe -Embedding 6633C23607EDE26D05E498A152408BC3 E Global\MSI0000C:\Windows\System32\msiexec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3076"C:\Users\admin\AppData\Local\Temp\is-4V505.tmp\cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp" /SL5="$5035A,21409018,1056768,C:\Users\admin\Desktop\cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe" C:\Users\admin\AppData\Local\Temp\is-4V505.tmp\cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp—cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-4v505.tmp\cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3208"C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe" -registerdll "C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapi.dll"C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
HIGH
Description:
Install Helper
Exit code:
0
Version:
5, 0, 05040
Modules
Images
c:\program files (x86)\cisco\cisco secure client\installhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3364C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3732"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\is-VKTTN.tmp\cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.msi" /qnC:\Windows\SysWOW64\msiexec.exe—cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
26 163
Read events
25 401
Write events
743
Delete events
19

Modification events

(PID) Process:(4388) cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E907010003001D00150008001B001403010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(4388) cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000F92F12F19172DB01
(PID) Process:(4388) cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CiscoClientAdmin
Value:
"C:\ProgramData\CiscoMedia\client32.exe"
(PID) Process:(1596) client32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1596) client32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1596) client32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3364) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
240D0000BED5ECF29172DB01
(PID) Process:(3364) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
AECC354191A4BA579C9B613DB2F36D7B1ACE254E5ADD1E7DFE356593B054C036
(PID) Process:(3364) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(3364) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0BCC9A290DFF71244A5B9C6A9E364F24
Operation:writeName:292005C41CB8461439E6512DAE85122F
Value:
02:\SYSTEM\CurrentControlSet\Services\Eventlog\Cisco Secure Client\csc_webhelper\
Executable files
101
Suspicious files
68
Text files
102
Unknown types
6

Dropped files

PID
Process
Filename
Type
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\Users\admin\AppData\Local\Temp\is-VKTTN.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
5872cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exeC:\Users\admin\AppData\Local\Temp\is-4V505.tmp\cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpexecutable
MD5:0C9B2469F1BBE633A84F87171FE068BE
SHA256:3919A8EFAA2FCF44C4B8215C647E811A38A8BD31C97825304E706BE41B0BDF24
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\Users\admin\AppData\Local\Temp\is-VKTTN.tmp\prflbmsg.mp3compressed
MD5:BCE64C218AB2D90739E1965F44EAEFC9
SHA256:38CB03BB108B88715D554D1141EB734B2DC25B63FC69C4B037E589CAA2E77BEC
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\AudioCapture.dllexecutable
MD5:2A82792F7B45D537EDFE58EB758C1197
SHA256:05AA13A6C1D18F691E552F04A996960917202A322D0DACFD330E553AD56978ED
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\getuname.dllexecutable
MD5:91C68038BFC064EA8FB6D432ACD38EE0
SHA256:68DE057C4175D4C94AFA2ACB2ABC1A9CCAC04A3CEB8E84C33F7F414BB8B0EEB6
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\client32.exeexecutable
MD5:1C19C2E97C5E6B30DE69EE684E6E5589
SHA256:312A0E4DB34A40CB95BA1FAC8BF87DEB45D0C5F048D38AC65EB060273B07DF67
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\client32.initext
MD5:5BAEBFB74E32C8825003A20F6F3AF32C
SHA256:5D2E3E095E7C0DE4CF4C83F3EA81127E5C96FF88C7C601AD41FD8FF10AB89947
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\HTCTL32.DLLexecutable
MD5:3EED18B47412D3F91A394AE880B56ED2
SHA256:13A17F2AD9288AAC8941D895251604BEB9524FA3C65C781197841EE15480A13F
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\msidntld.dllexecutable
MD5:504E51418D856D664DB23DD55A61352D
SHA256:F190E142F402DE460455FF2D1835294A3E118BA74D76AA092AF49372BB9B76F4
4388cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.tmpC:\ProgramData\CiscoMedia\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
28
DNS requests
16
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6068
svchost.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
RUXIMICS.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
RUXIMICS.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6068
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1596
client32.exe
POST
502
91.222.173.67:443
http://91.222.173.67/fakeurl.htm
unknown
—
—
unknown
1596
client32.exe
GET
200
104.26.1.231:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
—
—
malicious
3364
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
6540
vpnagent.exe
GET
—
72.163.1.80:80
http://mus.cisco.com/
unknown
—
—
whitelisted
3364
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEATsU0ch1gyF%2BeVfK%2Fce7QU%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
92.123.104.11:443
—
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6068
svchost.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
RUXIMICS.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6068
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4712
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5496
RUXIMICS.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
geo.netsupportsoftware.com
  • 104.26.1.231
  • 104.26.0.231
  • 172.67.68.212
unknown
monagpt.com
  • 91.222.173.67
unknown
mtsalesfunnel.com
  • 199.188.200.195
unknown
ocsp.digicert.com
  • 2.23.77.188
whitelisted
mus.cisco.com
  • 72.163.1.80
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted

Threats

PID
Process
Class
Message
1596
client32.exe
Potential Corporate Privacy Violation
ET REMOTE_ACCESS NetSupport GeoLocation Lookup Request
1596
client32.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
1596
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
1596
client32.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
1596
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cisco-secure-client-win-5.0.05040-core-vpn-predeploy-k9.exe