File name:

UpdateAXGATE_VPN_Client.exe

Full analysis: https://app.any.run/tasks/0dcde870-ecb3-4c72-81d0-38781e1eabc8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 05, 2024, 10:26:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

A144210866B3DF7D8EF5A4A10DEFBBE5

SHA1:

F9765345EA38CB7C953DD745B0F157AEB4D79A55

SHA256:

7AD32718D840C46BF294CF0A6EA03B80A6DA40C0FDD6FE5ADF6EA36DDFB67558

SSDEEP:

49152:uMECrOQhvlvgAjq6YxHD3gHzlEXDknVrY79Hlmjh6ZNCqdP7kxcNP81DzUMazGcT:uMRrFoAjpcjw0DuVW326PZ4V1DzUMaAM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the date of Windows installation

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Executes application which crashes

      • UpdatePatch.exe (PID: 5400)

    • Connects to unusual port

      • UpdateAgent_http_210.178.134.254_7778.exe (PID: 5988)

    • Executable content was dropped or overwritten

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)
      • UpdateAgent_http_210.178.134.254_7778.exe (PID: 5988)
      • AXGATE_VPN_Client_Installer.exe (PID: 6852)
      • AXGATE_VPN_Client_Installer.exe (PID: 2632)
      • vcredist_x86_VC2013.exe (PID: 4404)
      • HashDialog.exe (PID: 300)
      • vcredist_x86_VC2013.exe (PID: 3448)
      • AxgateVpnClient.exe (PID: 2640)

    • Reads security settings of Internet Explorer

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Potential Corporate Privacy Violation

      • UpdateAgent_http_210.178.134.254_7778.exe (PID: 5988)

    • Uses REG/REGEDIT.EXE to modify registry

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Starts itself from another location

      • AXGATE_VPN_Client_Installer.exe (PID: 6852)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1280)
      • vcredist_x86_VC2013.exe (PID: 3448)
      • vcredist_x86_VC2013.exe (PID: 4404)
      • msiexec.exe (PID: 1232)

    • Starts a Microsoft application from unusual location

      • vcredist_x86_VC2013.exe (PID: 4404)
      • vcredist_x86_VC2013.exe (PID: 3448)

    • Application launched itself

      • vcredist_x86_VC2013.exe (PID: 4404)

    • Starts CMD.EXE for commands execution

      • AXGATE_VPN_Client_Installer.exe (PID: 2632)
      • UpdateAgent_http_210.178.134.254_7778.exe (PID: 5988)

    • Drops a system driver (possible attempt to evade defenses)

      • HashDialog.exe (PID: 300)

    • The process deletes folder without confirmation

      • AXGATE_VPN_Client_Installer.exe (PID: 2632)

    • Executing commands from a ".bat" file

      • UpdateAgent_http_210.178.134.254_7778.exe (PID: 5988)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6716)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 1232)

  • INFO

    • Checks supported languages

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Creates files in the program directory

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Reads the computer name

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Process checks computer location settings

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • The process uses the downloaded file

      • UpdateAXGATE_VPN_Client.exe (PID: 3824)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 1232)

    • Manages system restore points

      • SrTasks.exe (PID: 1144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:12 10:17:15+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 236032
InitializedDataSize: 270848
UninitializedDataSize: -
EntryPoint: 0x266b0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
38
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start updateaxgate_vpn_client.exe updateagent_http_210.178.134.254_7778.exe no specs updateagent_http_210.178.134.254_7778.exe updatepatch.exe conhost.exe no specs reg.exe no specs conhost.exe no specs werfault.exe axgate_vpn_client_installer.exe axgate_vpn_client_installer.exe msiexec.exe msiexec.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs vcredist_x86_vc2013.exe vcredist_x86_vc2013.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs hashdialog.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs axgatevpnclient.exe cmd.exe no specs conhost.exe no specs updateagent_temp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\Users\admin\AppData\Local\Temp\{D29019F5-2F41-41B6-9696-B6925C6445F1}\HashDialog.exe C:\ProgramData\AXGATE\AXGATE VPN Client\C:\Users\admin\AppData\Local\Temp\{D29019F5-2F41-41B6-9696-B6925C6445F1}\HashDialog.exe
AXGATE_VPN_Client_Installer.exe
User:
admin
Company:
AXGATE Co., Ltd
Integrity Level:
HIGH
Description:
HashDialog
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\users\admin\appdata\local\temp\{d29019f5-2f41-41b6-9696-b6925c6445f1}\hashdialog.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1144C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1280C:\Windows\syswow64\MsiExec.exe -Embedding CBAF11CCC05B74A093E496C84729824E CC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1556C:\Windows\syswow64\MsiExec.exe -Embedding C8713EA6FEF601FDB83E8AEDC8610FB0C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1972C:\Users\admin\AppData\Local\Temp\{D29019F5-2F41-41B6-9696-B6925C6445F1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C255C6DA-A839-403C-932C-A819603EDFC3}C:\Users\admin\AppData\Local\Temp\{D29019F5-2F41-41B6-9696-B6925C6445F1}\ISBEW64.exe—AXGATE_VPN_Client_Installer.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
28.0.759
Modules
Images
c:\users\admin\appdata\local\temp\{d29019f5-2f41-41b6-9696-b6925c6445f1}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2632C:\Users\admin\AppData\Local\Temp\{03EC156F-C389-45C5-B020-AA4D95C9AA08}\AXGATE_VPN_Client_Installer.exe /q"C:\Users\admin\AppData\Roaming\AXGATE\AXGATE_VPN_Client_Installer.exe" /tempdisk1folder"C:\Users\admin\AppData\Local\Temp\{03EC156F-C389-45C5-B020-AA4D95C9AA08}" -S /IS_tempC:\Users\admin\AppData\Local\Temp\{03EC156F-C389-45C5-B020-AA4D95C9AA08}\AXGATE_VPN_Client_Installer.exe
AXGATE_VPN_Client_Installer.exe
User:
admin
Company:
AXGATE
Integrity Level:
HIGH
Description:
Setup Launcher Unicode
Exit code:
0
Version:
1.4.0.43
Modules
Images
c:\users\admin\appdata\local\temp\{03ec156f-c389-45c5-b020-aa4d95c9aa08}\axgate_vpn_client_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2640"C:\ProgramData\AXGATE\AXGATE VPN Client\Bin\AxgateVpnClient.exe" C:\ProgramData\AXGATE\AXGATE VPN Client\Bin\AxgateVpnClient.exe
UpdateAgent_http_210.178.134.254_7778.exe
User:
admin
Company:
AXGATE Co., Ltd
Integrity Level:
HIGH
Description:
AXGATE VPN Client
Version:
1, 4, 0, 43
Modules
Images
c:\programdata\axgate\axgate vpn client\bin\axgatevpnclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
Total events
21 087
Read events
20 135
Write events
859
Delete events
93

Modification events

(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:writeName:UseCustomTrayIcon
Value:
0
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:delete valueName:SystemVersion
Value:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:delete valueName:SystemVersion2
Value:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:delete valueName:FindProcessName
Value:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:delete valueName:FindProcessNameMac
Value:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:delete valueName:FindProcessHash
Value:
(PID) Process:(5988) UpdateAgent_http_210.178.134.254_7778.exeKey:HKEY_CURRENT_USER\SOFTWARE\AXGATE\AxgateVpnClient\Settings
Operation:delete valueName:FindProcessHashMac
Value:
Executable files
90
Suspicious files
92
Text files
39
Unknown types
1

Dropped files

PID
Process
Filename
Type
4484WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_UpdatePatch.exe_3579125eabccbd6b7f9798ceaae33564a828d3f_06d669a9_583f8073-f75e-446a-bb92-9e845601d19a\Report.wer —
MD5:—
SHA256:—
5988UpdateAgent_http_210.178.134.254_7778.exeC:\Users\admin\AppData\Roaming\updateUI.inibinary
MD5:E8B7E85FB43CE48A20417B7570319EB6
SHA256:1FB517486A8F0085C5CEA0A4C73ADF1FD60ECC4CD1E7CAB69DA37590FA421CE0
3824UpdateAXGATE_VPN_Client.exeC:\ProgramData\AXGATE\AXGATE VPN Client\Bin\UpdatePatch.exeexecutable
MD5:39F877B469DDE11E06979A111FFDD590
SHA256:847FF4FDFB746066F56FA607C3F06E259C94277472770791D161C84CE927AB50
4484WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER782B.tmp.dmpbinary
MD5:4A8DBC94D5A1F34EBA6C3376ACE6CE47
SHA256:EA790676429C1A141A71593F6EBB03AAAAA88320E90DCCED66697034B05DC7C4
3824UpdateAXGATE_VPN_Client.exeC:\ProgramData\AXGATE\AXGATE VPN Client\Bin\UpdateAgent_http_210.178.134.254_7778.exeexecutable
MD5:4B8D6D43EF6A30830EFB466ADB1F4716
SHA256:6E1C9E432AF515D1AF5915021DE87F9B7289BCCC2C16EB18DA87704E7450E75D
2632AXGATE_VPN_Client_Installer.exeC:\Users\admin\AppData\Local\Temp\{03EC156F-C389-45C5-B020-AA4D95C9AA08}\AXGATE VPN Client.msi —
MD5:—
SHA256:—
2632AXGATE_VPN_Client_Installer.exeC:\Users\admin\AppData\Local\Downloaded Installations\{09CD551F-FAF7-4C84-8816-C2E414C48FA8}\AXGATE VPN Client.msi —
MD5:—
SHA256:—
5988UpdateAgent_http_210.178.134.254_7778.exeC:\Users\admin\AppData\Roaming\configVersion.inibinary
MD5:C38458BC02EA766BE3709BC714D697BA
SHA256:50014C40E052815AF6EAFD8F8AA87F369C2F0F70D7C8BDC62ABB6A7680D245B0
4484WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER79A3.tmp.WERInternalMetadata.xmlxml
MD5:E8413819F32AD4A63A5F398CED1828C9
SHA256:4AB61516577F5268D6841D20D5E7CD171D066AA056005F902C3F7DCF00BEB27F
5988UpdateAgent_http_210.178.134.254_7778.exeC:\Users\admin\AppData\Roaming\version.initext
MD5:557E511D6D06CA08E2C55C4EB913D36F
SHA256:8F531E36AF200072B22D3D1BC4B0032B9407D5372C3AC1F9D71F7A0069B96DA6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
52
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5988
UpdateAgent_http_210.178.134.254_7778.exe
POST
200
210.178.134.254:7778
http://210.178.134.254:7778/install_files.cgi
unknown
—
—
malicious
5988
UpdateAgent_http_210.178.134.254_7778.exe
POST
200
210.178.134.254:7778
http://210.178.134.254:7778/install_files.cgi
unknown
—
—
malicious
5988
UpdateAgent_http_210.178.134.254_7778.exe
POST
200
210.178.134.254:7778
http://210.178.134.254:7778/install_files.cgi
unknown
—
—
malicious
5988
UpdateAgent_http_210.178.134.254_7778.exe
POST
200
210.178.134.254:7778
http://210.178.134.254:7778/install_files.cgi
unknown
—
—
malicious
4484
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1636
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1636
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3848
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4288
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5400
UpdatePatch.exe
193.122.105.160:8080
—
ORACLE-BMC-31898
KR
unknown
5988
UpdateAgent_http_210.178.134.254_7778.exe
210.178.134.254:7778
—
National Health Insurance Service
KR
unknown
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4484
WerFault.exe
104.208.16.94:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.238
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.68
  • 20.190.159.23
  • 40.126.31.67
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
5988
UpdateAgent_http_210.178.134.254_7778.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5988
UpdateAgent_http_210.178.134.254_7778.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5988
UpdateAgent_http_210.178.134.254_7778.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UpdateAXGATE_VPN_Client.exe