File name:

anyconnect-win-4.4.03034-core-vpn-predeploy-k9.msi

Full analysis: https://app.any.run/tasks/476c566c-c581-4f89-ac71-db28c7cb2ed6
Verdict: Malicious activity
Analysis date: February 11, 2020, 07:19:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {A261D977-6F4A-4721-A08D-CDE3682D2281}, Number of Words: 2, Subject: Cisco AnyConnect Secure Mobility Client, Author: Cisco Systems, Inc., Name of Creating Application: Advanced Installer 7.5.2, Template: ;1033, Comments: A SmartNET contract is required for support - Cisco AnyConnect Secure Mobility Client.
MD5:

96FD30E2FBAC7385AD9181ADE124D290

SHA1:

F473B80483415ABCA9B687AD0E71898F650B4DA5

SHA256:

AAD8ADD65AD9E5D2C80DD6618E79D99424C87D09D4E919C56CAADF5427F798EE

SSDEEP:

196608:EgjWhMv3diT6Vjm2Z+bpW7nLe/LIRilxda/ZcVwk0wEGf:EgjWhMv342ZPUD0SVwl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • InstallHelper.exe (PID: 3560)
      • InstallHelper.exe (PID: 440)
      • InstallHelper.exe (PID: 3192)
      • InstallHelper.exe (PID: 3724)
      • InstallHelper.exe (PID: 2588)
      • InstallHelper.exe (PID: 2928)
      • InstallHelper.exe (PID: 3324)
      • InstallHelper.exe (PID: 3912)
      • InstallHelper.exe (PID: 2852)
      • InstallHelper.exe (PID: 1932)
      • vpnagent.exe (PID: 2668)
      • InstallHelper.exe (PID: 1844)
      • InstallHelper.exe (PID: 3672)
      • InstallHelper.exe (PID: 2960)
      • vpnui.exe (PID: 1828)

    • Application was dropped or rewritten from another process

      • InstallHelper.exe (PID: 3192)
      • InstallHelper.exe (PID: 3560)
      • InstallHelper.exe (PID: 440)
      • InstallHelper.exe (PID: 2588)
      • InstallHelper.exe (PID: 2928)
      • InstallHelper.exe (PID: 3324)
      • InstallHelper.exe (PID: 3724)
      • InstallHelper.exe (PID: 3912)
      • InstallHelper.exe (PID: 2852)
      • InstallHelper.exe (PID: 1932)
      • VACon.exe (PID: 3564)
      • vpnagent.exe (PID: 2668)
      • VACon.exe (PID: 2564)
      • InstallHelper.exe (PID: 3672)
      • InstallHelper.exe (PID: 2960)
      • ManifestTool.exe (PID: 2716)
      • vpnui.exe (PID: 1828)
      • InstallHelper.exe (PID: 1844)

    • Changes the autorun value in the registry

      • VACon.exe (PID: 3564)
      • vpnagent.exe (PID: 2668)

    • Tries to delete the host file

      • vpnagent.exe (PID: 2668)

    • Changes settings of System certificates

      • vpnagent.exe (PID: 2668)
      • VACon.exe (PID: 2564)

  • SUSPICIOUS

    • Executed as Windows Service

      • vssvc.exe (PID: 3600)
      • vpnagent.exe (PID: 2668)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3508)
      • VACon.exe (PID: 3564)
      • DrvInst.exe (PID: 1232)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 3508)
      • VACon.exe (PID: 3564)
      • vpnagent.exe (PID: 2668)
      • DrvInst.exe (PID: 2628)
      • DrvInst.exe (PID: 1232)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3508)

    • Creates COM task schedule object

      • InstallHelper.exe (PID: 2852)

    • Creates files in the driver directory

      • VACon.exe (PID: 3564)
      • vpnagent.exe (PID: 2668)
      • DrvInst.exe (PID: 2628)
      • DrvInst.exe (PID: 1232)

    • Creates files in the program directory

      • InstallHelper.exe (PID: 1932)
      • ManifestTool.exe (PID: 2716)

    • Removes files from Windows directory

      • VACon.exe (PID: 3564)
      • vpnagent.exe (PID: 2668)
      • DrvInst.exe (PID: 2628)
      • DrvInst.exe (PID: 1232)

    • Executed via COM

      • DrvInst.exe (PID: 2628)
      • rundll32.exe (PID: 1512)
      • DrvInst.exe (PID: 1232)

    • Reads internet explorer settings

      • vpnui.exe (PID: 1828)

    • Creates files in the user directory

      • notepad++.exe (PID: 3424)

    • Adds / modifies Windows certificates

      • VACon.exe (PID: 2564)
      • vpnagent.exe (PID: 2668)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 3508)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3600)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 3508)

    • Searches for installed software

      • msiexec.exe (PID: 3508)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3508)

    • Creates or modifies windows services

      • msiexec.exe (PID: 3508)

    • Creates files in the program directory

      • msiexec.exe (PID: 3508)

    • Reads the hosts file

      • vpnagent.exe (PID: 2668)
      • notepad++.exe (PID: 3424)

    • Reads settings of System Certificates

      • VACon.exe (PID: 2564)
      • vpnagent.exe (PID: 2668)

    • Manual execution by user

      • notepad++.exe (PID: 3424)
      • explorer.exe (PID: 2728)
      • vpnui.exe (PID: 1828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Title: Installation Database
Keywords: Installer, MSI, Database
LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2009:12:11 11:47:44
Pages: 200
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {A261D977-6F4A-4721-A08D-CDE3682D2281}
Words: 2
Subject: Cisco AnyConnect Secure Mobility Client
Author: Cisco Systems, Inc.
LastModifiedBy: -
Software: Advanced Installer 7.5.2
Template: ;1033
Comments: A SmartNET contract is required for support - Cisco AnyConnect Secure Mobility Client.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
32
Malicious processes
20
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start msiexec.exe no specs msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs vacon.exe runonce.exe grpconv.exe no specs installhelper.exe no specs vpnagent.exe vacon.exe drvinst.exe no specs drvinst.exe installhelper.exe no specs rundll32.exe no specs installhelper.exe no specs installhelper.exe no specs manifesttool.exe no specs msiexec.exe no specs vpnui.exe explorer.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
0
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1232DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "vpnva-6.inf:Cisco:Cisco.ndi.NTx86:3.1.6019.0:vpnva" "658dd218b" "000005C8" "000005D4" "000005D8"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1512C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1828"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
explorer.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
Cisco AnyConnect User Interface
Exit code:
0
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\vpnui.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1844"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -createLink "C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpndownloader.exe" "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
0
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1932"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -acpolgen bd=false fm=false rpc=false rtp=false rwl=false sct=false epf=false ewn=false emn=false efn=false upsu=true upcu=true upvp=true upip=true upsp=true upal= ecc=falseC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
0
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2564"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\VACon.exe" -install "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnva-6.inf" VPNVAC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\VACon.exe
msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Virtual Adapter Installer
Exit code:
0
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\vacon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\newdev.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2588"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
1
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2628DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{162edf15-903d-6ace-fe64-c4415fda6c4e}\vpnva-6.inf" "0" "658dd218b" "000005C8" "WinSta0\Default" "00000554" "208" "c:\program files\cisco\cisco anyconnect secure mobility client"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2668"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
services.exe
User:
SYSTEM
Company:
Cisco Systems, Inc.
Integrity Level:
SYSTEM
Description:
VPN Agent Service
Exit code:
0
Version:
4, 4, 03034
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\vpnagent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
Total events
3 867
Read events
1 027
Write events
2 783
Delete events
57

Modification events

(PID) Process:(3692) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000005E0F449AABE0D501B40D0000B80B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000005E0F449AABE0D501B40D0000B80B0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3600) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000006E6DA39AABE0D501100E00001C0C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3600) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000006E6DA39AABE0D501100E0000800C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3600) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000006E6DA39AABE0D501100E0000640E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3600) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000006E6DA39AABE0D501100E0000B80E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3600) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000D6F6AC9AABE0D501100E0000B80E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3600) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000D6F6AC9AABE0D501100E0000800C0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3508) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
34
Executable files
80
Suspicious files
21
Text files
166
Unknown types
7

Dropped files

PID
Process
Filename
Type
3692msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI76CE.tmp —
MD5:—
SHA256:—
3692msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI774C.tmp —
MD5:—
SHA256:—
3508msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3508msiexec.exeC:\Windows\Installer\a6b54e.msi —
MD5:—
SHA256:—
3508msiexec.exeC:\Windows\Installer\MSIBA40.tmp —
MD5:—
SHA256:—
3508msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF3116F27B4F2AEB73.TMP —
MD5:—
SHA256:—
3508msiexec.exeC:\Windows\Installer\MSIBC36.tmp —
MD5:—
SHA256:—
3508msiexec.exeC:\Windows\Installer\MSIBC56.tmp —
MD5:—
SHA256:—
3600vssvc.exeC: —
MD5:—
SHA256:—
3508msiexec.exeC:\Windows\Installer\MSIBC06.tmpbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
2668
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
2668
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2668
vpnagent.exe
72.163.1.80:80
mus.cisco.com
Cisco Systems, Inc.
US
unknown
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2888
gup.exe
104.31.89.28:443
notepad-plus-plus.org
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
mus.cisco.com
  • 72.163.1.80
whitelisted
notepad-plus-plus.org
  • 104.31.89.28
  • 104.31.88.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
Process
Message
VACon.exe
VACON: -install
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
anyconnect-win-4.4.03034-core-vpn-predeploy-k9.msi