File name:

CheraxLoader.exe

Full analysis: https://app.any.run/tasks/e13dc5e2-f2e9-466d-b0b6-f29c141f1c70
Verdict: Malicious activity
Analysis date: June 16, 2025, 16:00:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
MD5:

1FC9C12C797276A2DC7CE7ADCB0D15A5

SHA1:

F20AE20E61DBC947CCA32DAF2B57FD84A4BACB58

SHA256:

B8E6348BE5899627251A955C60010050E60A71341810C5A08BC4326A3E0EC0E5

SSDEEP:

98304:alku/J4yn6eIfWES8VlpCKHwFvEbbS0+/EH9UTI9iZdSIBu40xQ0Bbvfd4hesSvm:aN/J+LBIBG9Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • vc_redist.x64.exe (PID: 2524)
      • vc_redist.x64.exe (PID: 3720)
      • CheraxLoader.exe (PID: 7052)
      • VC_redist.x64.exe (PID: 2996)
      • VC_redist.x64.exe (PID: 4844)
      • VC_redist.x64.exe (PID: 640)

    • Starts a Microsoft application from unusual location

      • vc_redist.x64.exe (PID: 3720)
      • VC_redist.x64.exe (PID: 2996)

    • Process drops legitimate windows executable

      • vc_redist.x64.exe (PID: 2524)
      • vc_redist.x64.exe (PID: 3720)
      • VC_redist.x64.exe (PID: 2996)
      • msiexec.exe (PID: 4172)
      • VC_redist.x64.exe (PID: 640)

    • Searches for installed software

      • vc_redist.x64.exe (PID: 3720)
      • dllhost.exe (PID: 1964)

    • Reads security settings of Internet Explorer

      • vc_redist.x64.exe (PID: 3720)

    • Starts itself from another location

      • vc_redist.x64.exe (PID: 3720)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5724)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4172)

    • Application launched itself

      • VC_redist.x64.exe (PID: 4844)
      • VC_redist.x64.exe (PID: 4684)
      • updater.exe (PID: 2724)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2724)
      • PLUGScheduler.exe (PID: 812)

  • INFO

    • Reads the computer name

      • CheraxLoader.exe (PID: 7052)
      • vc_redist.x64.exe (PID: 2524)
      • vc_redist.x64.exe (PID: 3720)
      • VC_redist.x64.exe (PID: 2996)

    • Checks supported languages

      • CheraxLoader.exe (PID: 7052)
      • vc_redist.x64.exe (PID: 2524)
      • vc_redist.x64.exe (PID: 3720)
      • VC_redist.x64.exe (PID: 2996)

    • The sample compiled with english language support

      • vc_redist.x64.exe (PID: 2524)
      • vc_redist.x64.exe (PID: 3720)
      • VC_redist.x64.exe (PID: 2996)
      • msiexec.exe (PID: 4172)
      • VC_redist.x64.exe (PID: 4844)
      • VC_redist.x64.exe (PID: 640)

    • Create files in a temporary directory

      • vc_redist.x64.exe (PID: 3720)

    • Process checks computer location settings

      • vc_redist.x64.exe (PID: 3720)

    • Manages system restore points

      • SrTasks.exe (PID: 6960)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4172)

    • Manual execution by a user

      • CheraxLoader.exe (PID: 2724)
      • CheraxLoader.exe (PID: 5004)
      • CheraxLoader.exe (PID: 6772)
      • CheraxLoader.exe (PID: 6820)
      • SystemSettings.exe (PID: 7120)
      • ApplicationFrameHost.exe (PID: 7128)
      • UserOOBEBroker.exe (PID: 6272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:06 12:40:55+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 2911744
InitializedDataSize: 1962496
UninitializedDataSize: -
EntryPoint: 0x428ffa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.3518
ProductVersionNumber: 1.0.0.3518
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Cherax
FileDescription: Cherax Loader
FileVersion: 1.0.0.3518
InternalName: Cherax.exe
LegalCopyright: Copyright (C) 2019 - 2023
OriginalFileName: Cherax.exe
ProductName: Cherax Loader
ProductVersion: 1.0.0.3518
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
315
Monitored processes
24
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start start cheraxloader.exe vc_redist.x64.exe vc_redist.x64.exe vc_redist.x64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe vc_redist.x64.exe no specs vc_redist.x64.exe vc_redist.x64.exe plugscheduler.exe no specs updater.exe no specs updater.exe no specs cheraxloader.exe no specs cheraxloader.exe cheraxloader.exe no specs cheraxloader.exe slui.exe systemsettings.exe no specs applicationframehost.exe no specs useroobebroker.exe no specs cheraxloader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\Desktop\CheraxLoader.exe" C:\Users\admin\Desktop\CheraxLoader.exe—explorer.exe
User:
admin
Company:
Cherax
Integrity Level:
MEDIUM
Description:
Cherax Loader
Exit code:
3221226540
Version:
1.0.0.3518
Modules
Images
c:\users\admin\desktop\cheraxloader.exe
c:\windows\system32\ntdll.dll
640"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C395A296-652D-4D64-B320-094B1C1A8B6E} {12ADA936-4EDA-4378-A4B6-5186637AF9F1} 4844C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532
Exit code:
0
Version:
14.36.32532.0
Modules
Images
c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
812"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1964C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
2524"C:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe"C:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe
CheraxLoader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35208
Exit code:
3010
Version:
14.44.35208.0
Modules
Images
c:\users\admin\documents\cherax\cache\downloads\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2724"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2724"C:\Users\admin\Desktop\CheraxLoader.exe" C:\Users\admin\Desktop\CheraxLoader.exe
explorer.exe
User:
admin
Company:
Cherax
Integrity Level:
HIGH
Description:
Cherax Loader
Exit code:
0
Version:
1.0.0.3518
Modules
Images
c:\users\admin\desktop\cheraxloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2996"C:\WINDOWS\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6838C274-1D74-4911-B3E9-7131A995742D} {F676F16E-9C5A-4286-A92F-A7CE675ADBE7} 3720C:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.be\VC_redist.x64.exe
vc_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35208
Exit code:
3010
Version:
14.44.35208.0
Modules
Images
c:\windows\temp\{d9d28198-97a3-4e87-8569-a500dd80fb57}\.be\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3720"C:\WINDOWS\Temp\{70F995C4-CCE2-4240-BD1D-1155C339CB94}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe" -burn.filehandle.attached=620 -burn.filehandle.self=572 C:\Windows\Temp\{70F995C4-CCE2-4240-BD1D-1155C339CB94}\.cr\vc_redist.x64.exe
vc_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35208
Exit code:
3010
Version:
14.44.35208.0
Modules
Images
c:\windows\temp\{70f995c4-cce2-4240-bd1d-1155c339cb94}\.cr\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4172C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
16 050
Read events
15 045
Write events
628
Delete events
377

Modification events

(PID) Process:(1964) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000004BE6C9C7D7DEDB01AC070000980D0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1964) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000A6E2E8C7D7DEDB01AC070000980D0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1964) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000A6E2E8C7D7DEDB01AC070000980D0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1964) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000A6E2E8C7D7DEDB01AC070000980D0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1964) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000975D1DC8D7DEDB01AC070000980D0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1964) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000000FC11FC8D7DEDB01AC07000080170000E80300000100000000000000000000001642E0771B05F044A453676BE51BAA7600000000000000000000000000000000
(PID) Process:(5724) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000A23C29C8D7DEDB015C160000780F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5724) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000A23C29C8D7DEDB015C16000008100000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5724) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000BE042EC8D7DEDB015C16000018100000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5724) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
Executable files
68
Suspicious files
38
Text files
71
Unknown types
66

Dropped files

PID
Process
Filename
Type
7052CheraxLoader.exeC:\Users\admin\Documents\Cherax\Loader.logtext
MD5:5D5919C0EC1AC3ABF958BBCB0B01A7A0
SHA256:1BCD2E41A704E2B3B6A1ED395913D50A604BF9D27CFBE730977F7FDAC8DAAD99
7052CheraxLoader.exeC:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exeexecutable
MD5:DE118D5E2AB7AAA7E1A08A0ECF84E8C9
SHA256:D62841375B90782B1829483AC75695CCEF680A8F13E7DE569B992EF33C6CD14A
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\license.rtftext
MD5:04B33F0A9081C10E85D0E495A1294F83
SHA256:8099DC3CF9502C335DA829E5C755948A12E3E6DE490EB492A99DEB673D883D8B
2524vc_redist.x64.exeC:\Windows\Temp\{70F995C4-CCE2-4240-BD1D-1155C339CB94}\.cr\vc_redist.x64.exeexecutable
MD5:DB2FEF85F5046E85EC2FC24089FE500A
SHA256:3814F726440521E12762A4F1D83DFDCF4C62B2CF71873987D87ECD54330095B5
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\wixstdba.dllexecutable
MD5:F68F43F809840328F4E993A54B0D5E62
SHA256:E921F69B9FB4B5AD4691809D06896C5F1D655AB75E0CE94A372319C243C56D4E
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\thm.xmlxml
MD5:F62729C6D2540015E072514226C121C7
SHA256:F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\logo.pngimage
MD5:D6BD210F227442B3362493D046CEA233
SHA256:335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\thm.wxlxml
MD5:FBFCBC4DACC566A3C426F43CE10907B6
SHA256:70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\1031\license.rtftext
MD5:2DDCA2866D76C850F68ACDFDB696D6DE
SHA256:28F63BAD9C2960395106011761993049546607F8A850D344D6A54042176BF03F
3720vc_redist.x64.exeC:\Windows\Temp\{D9D28198-97A3-4E87-8569-A500DD80FB57}\.ba\1041\thm.wxlxml
MD5:DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA256:6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
88
DNS requests
40
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
764
lsass.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSzT%2FzqwcqNvhP9i4c4sCPz2JbzrAQU%2FglxQFUFEETYpIF1uJ4a6UoGiMgCEzMBilrNSMTD3UPhbg4AAAGKWs0%3D
unknown
—
—
whitelisted
2552
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4172
msiexec.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4172
msiexec.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
6304
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6304
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2228
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7052
CheraxLoader.exe
84.53.189.169:443
aka.ms
AKAMAI-AS
NL
whitelisted
764
lsass.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7052
CheraxLoader.exe
199.232.210.172:443
download.visualstudio.microsoft.com
FASTLY
US
whitelisted
764
lsass.exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2552
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
aka.ms
  • 84.53.189.169
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
download.visualstudio.microsoft.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.2
  • 20.190.160.67
  • 20.190.160.66
  • 20.190.160.5
  • 40.126.32.134
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted

Threats

No threats detected
Process
Message
msiexec.exe
Failed to release Service
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CheraxLoader.exe