File name:

2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop

Full analysis: https://app.any.run/tasks/3171c797-bcad-4b06-9649-38aadbb72ebf
Verdict: Malicious activity
Analysis date: July 06, 2025, 03:48:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

95D59D77FDD2D724E99FA04EAF98AA50

SHA1:

3328A8085DD037F24C8DAFE56F447B8E743CD3DA

SHA256:

FC65E7D60D333937FC89F23FF1B56F4E7F0E5E5B2866E0770DF4E8D2C2A7D2EA

SSDEEP:

12288:BCXObisrKb7AY9469aC+aNpcVnu1UZ2Orz:BCXoihJPaC+aNH1UZ2Orz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Starts a Microsoft application from unusual location

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Executable content was dropped or overwritten

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Starts itself from another location

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)
      • rsvp.exe (PID: 4804)

    • Application launched itself

      • rsvp.exe (PID: 4804)

    • Reads security settings of Internet Explorer

      • rsvp.exe (PID: 4804)

  • INFO

    • The sample compiled with english language support

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Checks supported languages

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)
      • rsvp.exe (PID: 1136)
      • spoolsv.exe (PID: 2124)
      • ieudinit.exe (PID: 4500)
      • rsvp.exe (PID: 5340)
      • rsvp.exe (PID: 4804)
      • rsvp.exe (PID: 3788)
      • spoolsv.exe (PID: 5284)
      • ieudinit.exe (PID: 5564)
      • rsvp.exe (PID: 2160)

    • Create files in a temporary directory

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Launching a file from a Registry key

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Failed to create an executable file in Windows directory

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Creates files or folders in the user directory

      • 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe (PID: 1212)

    • Manual execution by a user

      • rsvp.exe (PID: 2160)

    • Checks proxy server information

      • rsvp.exe (PID: 4804)
      • slui.exe (PID: 5236)

    • Reads the software policy settings

      • slui.exe (PID: 5236)

    • Reads the computer name

      • rsvp.exe (PID: 4804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:08:11 14:41:40+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 263168
InitializedDataSize: 116736
UninitializedDataSize: -
EntryPoint: 0x2ab4b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 7.0.5730.13
ProductVersionNumber: 7.0.5730.13
FileFlagsMask: 0x003f
FileFlags: Private build, Special build
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments:
CompanyName: Microsoft Corporation
FileDescription: IE Per User Active Setup Uninstall Utility
FileVersion: 7.00.5730.13
InternalName: IEUDINIT
LegalCopyright: ﾩ Microsoft Corporation. All rights reserved.
LegalTrademarks: ﾩ Microsoft Corporation. All rights reserved.
OriginalFileName: IEUDINIT.EXE
PrivateBuild: IEUDINIT.EXE
ProductName: Windowsﾮ Internet Explorer
ProductVersion: 7.00.5730.13
SpecialBuild: 7.00.5730.13
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
11
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe rsvp.exe no specs spoolsv.exe no specs ieudinit.exe no specs rsvp.exe no specs rsvp.exe rsvp.exe no specs spoolsv.exe no specs ieudinit.exe no specs rsvp.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Users\admin\Local Settings\Application Data\Microsoft\Windows\rsvp.exe" /c 79C:\Users\admin\AppData\Local\Microsoft\Windows\rsvp.exe—2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft RSVP
Exit code:
416
Version:
5.1.2600.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\rsvp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1212"C:\Users\admin\Desktop\2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe" C:\Users\admin\Desktop\2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Per User Active Setup Uninstall Utility
Exit code:
0
Version:
7.00.5730.13
Modules
Images
c:\users\admin\desktop\2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2124C:\Users\admin\AppData\Roaming\MICROS~1\spoolsv.exe /c 91C:\Users\admin\AppData\Roaming\Microsoft\spoolsv.exe—2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Spooler SubSystem App
Exit code:
476
Version:
5.1.2600.5512
Modules
Images
c:\users\admin\appdata\roaming\microsoft\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2160"C:\Users\admin\Local Settings\Application Data\Microsoft\Windows\rsvp.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\rsvp.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft RSVP
Exit code:
0
Version:
5.1.2600.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\rsvp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3788"C:\Users\admin\Local Settings\Application Data\Microsoft\Windows\rsvp.exe" /c 31C:\Users\admin\AppData\Local\Microsoft\Windows\rsvp.exe—rsvp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft RSVP
Exit code:
176
Version:
5.1.2600.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\rsvp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4500C:\Users\admin\AppData\Roaming\ieudinit.exe /c 16C:\Users\admin\AppData\Roaming\ieudinit.exe—2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Per User Active Setup Uninstall Utility
Exit code:
101
Version:
7.00.5730.13
Modules
Images
c:\users\admin\appdata\roaming\ieudinit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4804"C:\Users\admin\Local Settings\Application Data\Microsoft\Windows\rsvp.exe" /rC:\Users\admin\AppData\Local\Microsoft\Windows\rsvp.exe
2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft RSVP
Version:
5.1.2600.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\rsvp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5236C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5284C:\Users\admin\AppData\Roaming\MICROS~1\spoolsv.exe /c 64C:\Users\admin\AppData\Roaming\Microsoft\spoolsv.exe—rsvp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Spooler SubSystem App
Exit code:
341
Version:
5.1.2600.5512
Modules
Images
c:\users\admin\appdata\roaming\microsoft\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5340"C:\Users\admin\Local Settings\Application Data\Microsoft\Windows\rsvp.exe" /c 91C:\Users\admin\AppData\Local\Microsoft\Windows\rsvp.exe—2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft RSVP
Exit code:
476
Version:
5.1.2600.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\rsvp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
5 421
Read events
5 420
Write events
1
Delete events
0

Modification events

(PID) Process:(1212) 2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft RSVP
Value:
C:\Users\admin\Local Settings\Application Data\Microsoft\Windows\rsvp.exe
Executable files
9
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Local\Microsoft\Windows\RCX5CF5.tmpexecutable
MD5:E63F3C38F3BCD592D0D91C5AED180BE3
SHA256:7EBA4CBE96EC083F1182BFDA24C7EEEAFEF513C851BAD1CF1A9B4D5D221DB76F
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Local\Microsoft\Windows\rsvp.exeexecutable
MD5:95D59D77FDD2D724E99FA04EAF98AA50
SHA256:FC65E7D60D333937FC89F23FF1B56F4E7F0E5E5B2866E0770DF4E8D2C2A7D2EA
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Local\Temp\Twain002.Mtxtext
MD5:7451669EA37F825CE1B5BF70BD5670FD
SHA256:CFC97F2DCA862A9A9C67FE7A47EC6EFD908087C1730E9FA0B7E16E378EA991B2
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Roaming\Microsoft\spoolsv.exeexecutable
MD5:95D59D77FDD2D724E99FA04EAF98AA50
SHA256:FC65E7D60D333937FC89F23FF1B56F4E7F0E5E5B2866E0770DF4E8D2C2A7D2EA
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Roaming\Microsoft\RCX5D24.tmpexecutable
MD5:DE932854CB396CB9B8A649E97BFA7256
SHA256:6408E83610EDD024C69C2FE61926E29A95EA3C5D0FBB721F7633B90C607F9B79
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Roaming\ieudinit.exeexecutable
MD5:95D59D77FDD2D724E99FA04EAF98AA50
SHA256:FC65E7D60D333937FC89F23FF1B56F4E7F0E5E5B2866E0770DF4E8D2C2A7D2EA
12122025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop.exeC:\Users\admin\AppData\Roaming\RCX5D74.tmpexecutable
MD5:FE31F3A5904A8BE303635EC1937FE0CF
SHA256:14E10FEEC84C11C1615BD016D5A8348A2B0DD7C7D298B30FB64BF6B88F10A935
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
24
DNS requests
12
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2512
RUXIMICS.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2512
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4804
rsvp.exe
GET
200
2.16.168.101:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
4804
rsvp.exe
GET
200
2.16.168.101:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2512
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
2512
RUXIMICS.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
lyrics-db.org
  • —
unknown
dns.msftncsi.com
  • 131.107.255.255
whitelisted
www.msftconnecttest.com
  • 2.16.168.101
  • 2.16.168.102
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 20.42.65.94
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Microsoft Connection Test
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
—
—
Misc activity
ET INFO Microsoft Connection Test
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-06_95d59d77fdd2d724e99fa04eaf98aa50_elex_rodecap_stop