What's this connection

It's not really established, because it's not really a connection. The original question was about:

Notice the "udp". There are no connections in UDP. netstat is overloading the word "ESTABLISHED" in a confusing way. It just means there has been a successful connect() call on the socket.

With a UDP socket, the connect() system call just sets the default destination for future send operations that don't specify a destination. netstat can show an "ESTABLISHED" UDP socket even if the destination is an unallocated IP address.

The only thing that can be determined from the netstat output is that there is a socket that is likely to send something to 151.196.0.38:53 at some future time. You can also guess that it intends to send more than one packet there, or it wouldn't have bothered to call connect(). In other words, this is a program that plans to do a lot of DNS queries.

-- The attacker-x92s overall goal would very probably be to convince other users to run an unsafe program, by using the digital signature to convince them that it is actually bona fide Microsoft software and therefore safe to run. -- security bulletin MS01-017 ushers in a new definition of "safe"