File name:

CheraxLoader.exe

Full analysis: https://app.any.run/tasks/f9605696-77fd-44ad-973e-5dbc6d951774
Verdict: Malicious activity
Analysis date: June 16, 2025, 15:33:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
MD5:

1FC9C12C797276A2DC7CE7ADCB0D15A5

SHA1:

F20AE20E61DBC947CCA32DAF2B57FD84A4BACB58

SHA256:

B8E6348BE5899627251A955C60010050E60A71341810C5A08BC4326A3E0EC0E5

SSDEEP:

98304:alku/J4yn6eIfWES8VlpCKHwFvEbbS0+/EH9UTI9iZdSIBu40xQ0Bbvfd4hesSvm:aN/J+LBIBG9Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • CheraxLoader.exe (PID: 1156)
      • vc_redist.x64.exe (PID: 1712)
      • vc_redist.x64.exe (PID: 6472)
      • VC_redist.x64.exe (PID: 6652)
      • VC_redist.x64.exe (PID: 7120)
      • msiexec.exe (PID: 2276)

    • Executable content was dropped or overwritten

      • vc_redist.x64.exe (PID: 1712)
      • VC_redist.x64.exe (PID: 6652)
      • vc_redist.x64.exe (PID: 6472)
      • CheraxLoader.exe (PID: 1156)
      • VC_redist.x64.exe (PID: 7120)
      • VC_redist.x64.exe (PID: 6868)

    • Searches for installed software

      • vc_redist.x64.exe (PID: 6472)
      • dllhost.exe (PID: 6688)

    • Starts a Microsoft application from unusual location

      • VC_redist.x64.exe (PID: 6652)
      • vc_redist.x64.exe (PID: 6472)

    • Starts itself from another location

      • vc_redist.x64.exe (PID: 6472)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5008)

    • The process executes via Task Scheduler

      • updater.exe (PID: 4164)
      • PLUGScheduler.exe (PID: 4156)

    • Application launched itself

      • VC_redist.x64.exe (PID: 6868)
      • updater.exe (PID: 4164)
      • VC_redist.x64.exe (PID: 4680)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 2276)

    • Reads security settings of Internet Explorer

      • vc_redist.x64.exe (PID: 6472)

  • INFO

    • The sample compiled with english language support

      • CheraxLoader.exe (PID: 1156)
      • vc_redist.x64.exe (PID: 6472)
      • vc_redist.x64.exe (PID: 1712)
      • VC_redist.x64.exe (PID: 6652)
      • msiexec.exe (PID: 2276)
      • VC_redist.x64.exe (PID: 6868)
      • VC_redist.x64.exe (PID: 7120)

    • Checks supported languages

      • vc_redist.x64.exe (PID: 6472)
      • vc_redist.x64.exe (PID: 1712)
      • VC_redist.x64.exe (PID: 6652)
      • CheraxLoader.exe (PID: 1156)

    • Reads the computer name

      • vc_redist.x64.exe (PID: 6472)
      • CheraxLoader.exe (PID: 1156)
      • VC_redist.x64.exe (PID: 6652)
      • vc_redist.x64.exe (PID: 1712)

    • Process checks computer location settings

      • vc_redist.x64.exe (PID: 6472)

    • Manages system restore points

      • SrTasks.exe (PID: 6148)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2276)

    • Create files in a temporary directory

      • vc_redist.x64.exe (PID: 6472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:06 12:40:55+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 2911744
InitializedDataSize: 1962496
UninitializedDataSize: -
EntryPoint: 0x428ffa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.3518
ProductVersionNumber: 1.0.0.3518
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Cherax
FileDescription: Cherax Loader
FileVersion: 1.0.0.3518
InternalName: Cherax.exe
LegalCopyright: Copyright (C) 2019 - 2023
OriginalFileName: Cherax.exe
ProductName: Cherax Loader
ProductVersion: 1.0.0.3518
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
313
Monitored processes
16
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start cheraxloader.exe vc_redist.x64.exe vc_redist.x64.exe vc_redist.x64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe vc_redist.x64.exe no specs vc_redist.x64.exe vc_redist.x64.exe plugscheduler.exe no specs updater.exe no specs updater.exe no specs cheraxloader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\Users\admin\AppData\Local\Temp\CheraxLoader.exe" C:\Users\admin\AppData\Local\Temp\CheraxLoader.exe
explorer.exe
User:
admin
Company:
Cherax
Integrity Level:
HIGH
Description:
Cherax Loader
Exit code:
1337
Version:
1.0.0.3518
Modules
Images
c:\users\admin\appdata\local\temp\cheraxloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1712"C:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe"C:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe
CheraxLoader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35208
Exit code:
3010
Version:
14.44.35208.0
Modules
Images
c:\users\admin\documents\cherax\cache\downloads\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2276C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3756"C:\Users\admin\AppData\Local\Temp\CheraxLoader.exe" C:\Users\admin\AppData\Local\Temp\CheraxLoader.exe—explorer.exe
User:
admin
Company:
Cherax
Integrity Level:
MEDIUM
Description:
Cherax Loader
Exit code:
3221226540
Version:
1.0.0.3518
Modules
Images
c:\users\admin\appdata\local\temp\cheraxloader.exe
c:\windows\system32\ntdll.dll
4156"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4164"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4680"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9387bec2-2f2b-48d1-a0ce-692c5df7042d} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{EB829D4A-D9F4-4588-8604-31CCE65AD61D} {56F7093C-09DC-4E60-A4CC-6B00B158B4BD} 6652C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe—VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532
Exit code:
0
Version:
14.36.32532.0
Modules
Images
c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5008C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5020"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x278,0x2a4,0x85c460,0x85c46c,0x85c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
12 551
Read events
11 583
Write events
600
Delete events
368

Modification events

(PID) Process:(6652) VC_redist.x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000021D63716D4DEDB01FC190000F0050000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6688) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000021D63716D4DEDB01201A0000101A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6688) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000085D95616D4DEDB01201A0000101A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6688) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000085D95616D4DEDB01201A0000101A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6688) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000085D95616D4DEDB01201A0000101A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6688) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000027F15D16D4DEDB01201A0000101A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6688) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000D0A48D16D4DEDB01201A0000101A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000067999916D4DEDB019013000058030000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000067999916D4DEDB0190130000181B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5008) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000F2FB9B16D4DEDB019013000010170000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
68
Suspicious files
35
Text files
69
Unknown types
66

Dropped files

PID
Process
Filename
Type
1156CheraxLoader.exeC:\Users\admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exeexecutable
MD5:DE118D5E2AB7AAA7E1A08A0ECF84E8C9
SHA256:D62841375B90782B1829483AC75695CCEF680A8F13E7DE569B992EF33C6CD14A
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\1031\license.rtftext
MD5:2DDCA2866D76C850F68ACDFDB696D6DE
SHA256:28F63BAD9C2960395106011761993049546607F8A850D344D6A54042176BF03F
1156CheraxLoader.exeC:\Users\admin\Documents\Cherax\Loader.logtext
MD5:DF628FBBD487314F72725710B6EE903C
SHA256:7118933B01820BBB5A9E667614BE6161519EEAC4843F354B0E1165481E400589
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\1036\thm.wxlxml
MD5:7B46AE8698459830A0F9116BC27DE7DF
SHA256:704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\wixstdba.dllexecutable
MD5:F68F43F809840328F4E993A54B0D5E62
SHA256:E921F69B9FB4B5AD4691809D06896C5F1D655AB75E0CE94A372319C243C56D4E
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\logo.pngimage
MD5:D6BD210F227442B3362493D046CEA233
SHA256:335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\1036\license.rtftext
MD5:A6E352E5804313CCDE3E4D5DDDDE122D
SHA256:5C13A65870D770D1642A4259EECB436257CA39016A0500F747BE9C79BE0C7009
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\1040\thm.wxlxml
MD5:D90BC60FA15299925986A52861B8E5D5
SHA256:0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\1041\thm.wxlxml
MD5:DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA256:6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
6472vc_redist.x64.exeC:\Windows\Temp\{401D4A6C-3B9E-478C-8159-9E17B088868E}\.ba\1040\license.rtftext
MD5:BC58AD6ABB16B982AEBADC121B37E706
SHA256:70ECF23C03B66A2B18E173332586AFA8F00F91E02A80628F4F9CB2521E27F6AC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
83
DNS requests
43
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
764
lsass.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
764
lsass.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5436
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2276
msiexec.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
5824
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4868
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1028
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
3832
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3676
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1156
CheraxLoader.exe
2.20.153.252:443
aka.ms
Telkom-Internet
ZA
whitelisted
764
lsass.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1156
CheraxLoader.exe
23.50.131.82:443
download.visualstudio.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4944
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4944
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
aka.ms
  • 2.20.153.252
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
download.visualstudio.microsoft.com
  • 23.50.131.82
  • 23.50.131.78
  • 23.50.131.87
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.14
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.17
  • 20.190.160.5
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.31.2
  • 40.126.31.130
  • 20.190.159.4
  • 20.190.159.75
  • 40.126.31.71
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
  • 52.111.227.13
whitelisted

Threats

No threats detected
Process
Message
msiexec.exe
Failed to release Service
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CheraxLoader.exe