ANY.RUN Interactive Sandbox
- Full browser-level visibility into phishing
- Huge database of samples and IOCs
- Interactivity in a safe environment
- Actionable Tier 1 reports
Get full visibility into malware and phishing behavior in a safe environment.
| File name: | agentx64.exe |
| Full analysis: | https://app.any.run/tasks/a960d48d-c5f8-4ecf-91d9-6922e7eed0c5 |
| Verdict: | No threats detected |
| Analysis date: | September 28, 2026, 05:23:16 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 5 sections |
| MD5: | 47FB7C5C54BB1809389E4EE3680258F6 |
| SHA1: | 1F9356E3E79FB71023002485D2690B091E7D66DE |
| SHA256: | 50B3103233A04CF23D075761BD2EA4829DD9AD85D24542A8785A5C99B2962B11 |
| SSDEEP: | 6144:NSXx3YCdKHqTJMPENXtmlaZvi3p6uDpsGw8FBCD+q9QvAQdQIV:NSXx3YCdKHqTJMSZviZ6uDpslYYDKvV |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Create files in a temporary directory
- agentx64.exe (PID: 3236)
Checks supported languages
- agentx64.exe (PID: 3236)
- agent.x64.exe (PID: 5992)
Reads the computer name
- agentx64.exe (PID: 3236)
- agent.x64.exe (PID: 5992)
Creates files or folders in the user directory
- agentx64.exe (PID: 3236)
Reads security settings of Internet Explorer
- agent.x64.exe (PID: 5992)
Application based on Rust
- agentx64.exe (PID: 3236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2026:09:23 20:05:02+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.44 |
| CodeSize: | 180736 |
| InitializedDataSize: | 59392 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2a840 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
158
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3236 | "C:\Users\admin\AppData\Local\Temp\agentx64.exe" | C:\Users\admin\AppData\Local\Temp\agentx64.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 5992 | "C:\Users\admin\AppData\Local\RedLotus\RuntimeCache\51ae4e68287deb379ce3a79253d62743c8e9d89bf8bb6a7044bbf135023135e4\agent.x64.exe" | C:\Users\admin\AppData\Local\RedLotus\RuntimeCache\51ae4e68287deb379ce3a79253d62743c8e9d89bf8bb6a7044bbf135023135e4\agent.x64.exe | agentx64.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3236 | agentx64.exe | C:\Users\admin\AppData\Local\RedLotus\RuntimeCache\51ae4e68287deb379ce3a79253d62743c8e9d89bf8bb6a7044bbf135023135e4\.redlotus-entry | text/data | |
MD5:1DAC08C667AE9BE3016B0019D8D99AEC | SHA256:91E863ED1E348D49CE03AC91ED41130C87FDC0BE6A67E1AA0368D70A560D869A | |||
| 3236 | agentx64.exe | C:\Users\admin\AppData\Local\RedLotus\RuntimeCache\51ae4e68287deb379ce3a79253d62743c8e9d89bf8bb6a7044bbf135023135e4\agent.x64.exe | executable | |
MD5:FF59EE7490E7153B4451D4A70312845D | SHA256:84541534949B670CBFE3DC3392AA6C53C843CDCBE4782B22D254F2BFEC06896A | |||
| 3236 | agentx64.exe | C:\Users\admin\AppData\Local\RedLotus\RuntimeCache\51ae4e68287deb379ce3a79253d62743c8e9d89bf8bb6a7044bbf135023135e4\.redlotus-ready | text/data | |
MD5:7B8993BDEBCCAABB0E9BC27CB942E6F6 | SHA256:0C76F1E755E5A8591BECB4E86AD28C140BC95C9D7FA49BFB120671DCD7F29747 | |||
| 3236 | agentx64.exe | C:\Users\admin\AppData\Local\Temp\RedLotusBridge_d184804599c23c64.exe | executable | |
MD5:B16FAA3E56EEDE474825BE555B1B81E9 | SHA256:AA4770D7D327E4930B19885312E610B021E18646815A03A3073C5FF35EBA595D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
69
TCP/UDP connections
46
DNS requests
23
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6512 | svchost.exe | GET | 200 | 2.21.20.152:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | NL | other | 825 b | whitelisted |
6512 | svchost.exe | GET | 200 | 23.59.18.102:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Secure%20Server%20CA%202026.crl | US | other | 773 b | whitelisted |
1156 | SIHClient.exe | GET | 304 | 20.165.94.63:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | US | — | — | whitelisted |
— | — | GET | 200 | 23.11.40.157:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | NL | other | 471 b | whitelisted |
3588 | svchost.exe | POST | 400 | 20.190.160.64:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | US | text/data | 203 b | whitelisted |
1156 | SIHClient.exe | GET | 200 | 135.233.95.135:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | US | — | — | whitelisted |
1156 | SIHClient.exe | GET | 200 | 20.165.94.63:443 | https://slscr.update.microsoft.com/sls/ping | US | — | — | whitelisted |
1156 | SIHClient.exe | GET | 304 | 20.165.94.63:443 | https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | US | — | — | whitelisted |
3588 | svchost.exe | POST | 400 | 20.190.160.64:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | US | text/data | 203 b | whitelisted |
3588 | svchost.exe | POST | 400 | 20.190.160.64:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | US | text/data | 203 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5264 | MoUsoCoreWorker.exe | 57.153.246.3:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6012 | slui.exe | 128.24.231.65:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 57.153.246.3:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5652 | svchost.exe | 57.153.246.3:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6512 | svchost.exe | 2.21.20.152:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
6512 | svchost.exe | 23.59.18.102:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
— | — | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 23.11.40.157:80 | ocsp.digicert.com | AKAMAI-AMS | NL | whitelisted |
— | — | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3588 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
activation-v2.sls.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |