d975903f6e9fe757890ebe5f204b38685e7135390e5fa5445db50d2511a2b1a2

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Autodesk License Activator.exe
Size 7.5MB
Sample260731-qetsgsba38
SHA256 d975903f6e9fe757890ebe5f204b38685e7135390e5fa5445db50d2511a2b1a2
MD5 6f2507b187b804ea0290e8496f9fe439
SHA1 7e22b1fc0ef93bee7be837b0b1de7038f529a854
SHA512 ad60deea5ead1609be594316e936311f084a4d2267b768579bb72e161a7dd5904345803168ed462c694ffdf6038c9411ede536095f9d2f3a58b76aa8184e06f3
SSDEEP 196608:5Wv+phJYDNAHmXiqKmqQeyLKpRdcVtX4njJ:5ljqDNAGXiTmrMpwVVaF
TLSH
T164763312767598D6E8664E348A63D924E27E7C616720D2D334993FFD0933AC46F3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
2728	lmgrd.exe
3932	lmgrd.exe
4188	lmgrd.exe
2052	lmgrd.exe
3932	adskflex.exe

Loads dropped DLL 5 IoCs

pid	Process
5852	MsiExec.exe
608	MsiExec.exe
608	MsiExec.exe
608	MsiExec.exe
1176	MsiExec.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmtools.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmutil.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\LicenseAdministration.pdf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\version.dll	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.rtf	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\nlm.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DF546A204EB0460E58.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1D612A28365C6B5D.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4BE91685-1632-47FC-B563-A8A542C6664C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f737.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF512EB008C58E6C11.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBED.tmp	msiexec.exe
File created	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\lmtools.ico	msiexec.exe
File created	C:\Windows\Installer\e59f73c.msi	msiexec.exe
File created	C:\Windows\Installer\e59f737.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e59f738.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f738.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DF82FF292E0A82DE00.TMP	msiexec.exe
File created	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBCD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\lmtools.ico	msiexec.exe
File created	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\nlm.mst	msiexec.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3152	sc.exe
404	sc.exe
4788	sc.exe
5704	sc.exe
4780	sc.exe
4680	sc.exe
5404	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3652	cmd.exe
2956	cmd.exe
3932	cmd.exe
2076	cmd.exe
3604	cmd.exe
3716	cmd.exe
2708	cmd.exe
900	cmd.exe
3236	cmd.exe
3708	cmd.exe
1412	cmd.exe
5404	cmd.exe
5124	cmd.exe
3536	cmd.exe
2460	cmd.exe
4556	cmd.exe
5756	cmd.exe
4172	cmd.exe
1068	cmd.exe
3244	cmd.exe
2896	cmd.exe
1256	cmd.exe
5000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5656	taskkill.exe
5452	taskkill.exe
2128	taskkill.exe
2404	taskkill.exe
2724	taskkill.exe
2032	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adsk-NLM\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Adsk-NLM\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Version = "185794564"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Transforms = "C:\\Windows\\Installer\\{4BE91685-1632-47FC-B563-A8A542C6664C}\\nlm.mst"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\ProductIcon = "C:\\Windows\\Installer\\{4BE91685-1632-47FC-B563-A8A542C6664C}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\58619EB42361CF745B368A5A246C66C4\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\PackageCode = "55B98EBBBAF085F4D8632D5C58260AF6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4BC698D839589114AA143BB5C9D87F42\58619EB42361CF745B368A5A246C66C4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\58619EB42361CF745B368A5A246C66C4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\ProductName = "Autodesk Network License Manager"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4BC698D839589114AA143BB5C9D87F42	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\PackageName = "nlm11-19-4-1-ipv4-ipv6-win64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2816	WMIC.exe
2816	WMIC.exe
2816	WMIC.exe
2816	WMIC.exe
5468	WMIC.exe
5468	WMIC.exe
5468	WMIC.exe
5468	WMIC.exe
4856	WMIC.exe
4856	WMIC.exe
4856	WMIC.exe
4856	WMIC.exe
2496	msiexec.exe
2496	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	5656	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2816	WMIC.exe
Token: SeSecurityPrivilege	2816	WMIC.exe
Token: SeTakeOwnershipPrivilege	2816	WMIC.exe
Token: SeLoadDriverPrivilege	2816	WMIC.exe
Token: SeSystemProfilePrivilege	2816	WMIC.exe
Token: SeSystemtimePrivilege	2816	WMIC.exe
Token: SeProfSingleProcessPrivilege	2816	WMIC.exe
Token: SeIncBasePriorityPrivilege	2816	WMIC.exe
Token: SeCreatePagefilePrivilege	2816	WMIC.exe
Token: SeBackupPrivilege	2816	WMIC.exe
Token: SeRestorePrivilege	2816	WMIC.exe
Token: SeShutdownPrivilege	2816	WMIC.exe
Token: SeDebugPrivilege	2816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2816	WMIC.exe
Token: SeRemoteShutdownPrivilege	2816	WMIC.exe
Token: SeUndockPrivilege	2816	WMIC.exe
Token: SeManageVolumePrivilege	2816	WMIC.exe
Token: 33	2816	WMIC.exe
Token: 34	2816	WMIC.exe
Token: 35	2816	WMIC.exe
Token: 36	2816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2816	WMIC.exe
Token: SeSecurityPrivilege	2816	WMIC.exe
Token: SeTakeOwnershipPrivilege	2816	WMIC.exe
Token: SeLoadDriverPrivilege	2816	WMIC.exe
Token: SeSystemProfilePrivilege	2816	WMIC.exe
Token: SeSystemtimePrivilege	2816	WMIC.exe
Token: SeProfSingleProcessPrivilege	2816	WMIC.exe
Token: SeIncBasePriorityPrivilege	2816	WMIC.exe
Token: SeCreatePagefilePrivilege	2816	WMIC.exe
Token: SeBackupPrivilege	2816	WMIC.exe
Token: SeRestorePrivilege	2816	WMIC.exe
Token: SeShutdownPrivilege	2816	WMIC.exe
Token: SeDebugPrivilege	2816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2816	WMIC.exe
Token: SeRemoteShutdownPrivilege	2816	WMIC.exe
Token: SeUndockPrivilege	2816	WMIC.exe
Token: SeManageVolumePrivilege	2816	WMIC.exe
Token: 33	2816	WMIC.exe
Token: 34	2816	WMIC.exe
Token: 35	2816	WMIC.exe
Token: 36	2816	WMIC.exe
Token: SeSecurityPrivilege	2496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5468	WMIC.exe
Token: SeSecurityPrivilege	5468	WMIC.exe
Token: SeTakeOwnershipPrivilege	5468	WMIC.exe
Token: SeLoadDriverPrivilege	5468	WMIC.exe
Token: SeSystemProfilePrivilege	5468	WMIC.exe
Token: SeSystemtimePrivilege	5468	WMIC.exe
Token: SeProfSingleProcessPrivilege	5468	WMIC.exe
Token: SeIncBasePriorityPrivilege	5468	WMIC.exe
Token: SeCreatePagefilePrivilege	5468	WMIC.exe
Token: SeBackupPrivilege	5468	WMIC.exe
Token: SeRestorePrivilege	5468	WMIC.exe
Token: SeShutdownPrivilege	5468	WMIC.exe
Token: SeDebugPrivilege	5468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5468	WMIC.exe
Token: SeRemoteShutdownPrivilege	5468	WMIC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2496	msiexec.exe
1528	msiexec.exe
5852	MsiExec.exe
608	MsiExec.exe
1176	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 5052	1920	Autodesk License Activator.exe	89
PID 5052 wrote to memory of 4680	5052	Autodesk License Activator.exe	90
PID 1920 wrote to memory of 4144	1920	Autodesk License Activator.exe	92
PID 4144 wrote to memory of 2724	4144	Autodesk License Activator.exe	93
PID 1920 wrote to memory of 3852	1920	Autodesk License Activator.exe	96
PID 3852 wrote to memory of 3236	3852	Autodesk License Activator.exe	97
PID 3236 wrote to memory of 3152	3236	cmd.exe	99
PID 3236 wrote to memory of 5124	3236	cmd.exe	100
PID 1920 wrote to memory of 5652	1920	Autodesk License Activator.exe	101
PID 5652 wrote to memory of 3652	5652	Autodesk License Activator.exe	102
PID 1920 wrote to memory of 1836	1920	Autodesk License Activator.exe	104
PID 1836 wrote to memory of 2956	1836	Autodesk License Activator.exe	105
PID 1920 wrote to memory of 5848	1920	Autodesk License Activator.exe	107
PID 5848 wrote to memory of 3708	5848	Autodesk License Activator.exe	108
PID 1920 wrote to memory of 5664	1920	Autodesk License Activator.exe	110
PID 5664 wrote to memory of 1412	5664	Autodesk License Activator.exe	111
PID 1920 wrote to memory of 1556	1920	Autodesk License Activator.exe	113
PID 1556 wrote to memory of 1256	1556	Autodesk License Activator.exe	114
PID 1920 wrote to memory of 948	1920	Autodesk License Activator.exe	116
PID 948 wrote to memory of 4556	948	Autodesk License Activator.exe	117
PID 1920 wrote to memory of 2544	1920	Autodesk License Activator.exe	119
PID 2544 wrote to memory of 3932	2544	Autodesk License Activator.exe	120
PID 1920 wrote to memory of 3864	1920	Autodesk License Activator.exe	122
PID 3864 wrote to memory of 5756	3864	Autodesk License Activator.exe	123
PID 1920 wrote to memory of 1700	1920	Autodesk License Activator.exe	125
PID 1700 wrote to memory of 2076	1700	Autodesk License Activator.exe	126
PID 1920 wrote to memory of 576	1920	Autodesk License Activator.exe	128
PID 576 wrote to memory of 2348	576	Autodesk License Activator.exe	129
PID 1920 wrote to memory of 1684	1920	Autodesk License Activator.exe	131
PID 1684 wrote to memory of 4948	1684	Autodesk License Activator.exe	132
PID 1920 wrote to memory of 3376	1920	Autodesk License Activator.exe	134
PID 3376 wrote to memory of 5404	3376	Autodesk License Activator.exe	179
PID 1920 wrote to memory of 2888	1920	Autodesk License Activator.exe	137
PID 2888 wrote to memory of 2032	2888	Autodesk License Activator.exe	138
PID 1920 wrote to memory of 5876	1920	Autodesk License Activator.exe	140
PID 5876 wrote to memory of 5656	5876	Autodesk License Activator.exe	141
PID 1920 wrote to memory of 3096	1920	Autodesk License Activator.exe	143
PID 3096 wrote to memory of 5452	3096	Autodesk License Activator.exe	144
PID 1920 wrote to memory of 4372	1920	Autodesk License Activator.exe	146
PID 4372 wrote to memory of 2128	4372	Autodesk License Activator.exe	147
PID 1920 wrote to memory of 1180	1920	Autodesk License Activator.exe	149
PID 1180 wrote to memory of 2404	1180	Autodesk License Activator.exe	150
PID 1920 wrote to memory of 3164	1920	Autodesk License Activator.exe	152
PID 1920 wrote to memory of 5676	1920	Autodesk License Activator.exe	153
PID 5676 wrote to memory of 3152	5676	Autodesk License Activator.exe	155
PID 1920 wrote to memory of 728	1920	Autodesk License Activator.exe	157
PID 728 wrote to memory of 404	728	Autodesk License Activator.exe	158
PID 1920 wrote to memory of 408	1920	Autodesk License Activator.exe	160
PID 408 wrote to memory of 4172	408	Autodesk License Activator.exe	161
PID 1920 wrote to memory of 1048	1920	Autodesk License Activator.exe	163
PID 1048 wrote to memory of 3604	1048	Autodesk License Activator.exe	164
PID 1920 wrote to memory of 4712	1920	Autodesk License Activator.exe	166
PID 4712 wrote to memory of 1068	4712	Autodesk License Activator.exe	167
PID 1068 wrote to memory of 2816	1068	cmd.exe	169
PID 1920 wrote to memory of 1988	1920	Autodesk License Activator.exe	172
PID 1988 wrote to memory of 5884	1988	Autodesk License Activator.exe	173
PID 1920 wrote to memory of 3292	1920	Autodesk License Activator.exe	175
PID 3292 wrote to memory of 3716	3292	Autodesk License Activator.exe	176
PID 1920 wrote to memory of 6040	1920	Autodesk License Activator.exe	178
PID 6040 wrote to memory of 5404	6040	Autodesk License Activator.exe	179
PID 5404 wrote to memory of 5468	5404	cmd.exe	181
PID 1920 wrote to memory of 3184	1920	Autodesk License Activator.exe	183
PID 3184 wrote to memory of 4788	3184	Autodesk License Activator.exe	184
PID 1920 wrote to memory of 248	1920	Autodesk License Activator.exe	186

C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" stop AdskLicensingService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop AdskLicensingService
    3⤵
    - Launches sc.exe
    PID:4680
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "taskkill" /im AdskLicensingAgent.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /im AdskLicensingAgent.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:3152
  - - C:\Windows\system32\xcopy.exe
      xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
      4⤵
      Drops file in Program Files directory
      PID:5124
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:3652
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:2956
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:3708
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:1412
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:1256
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:4556
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:3932
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:5756
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:2076
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R30\LMU.exe" ( echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\netapi32.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R30" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R30\LMU.exe" ( echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\netapi32.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R30" )
    3⤵
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R30\LMU.exe" ( echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\netapi32.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R30\LMU.exe" ( echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\netapi32.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent" )
    3⤵
    PID:4948
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" start AdskLicensingService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start AdskLicensingService
    3⤵
    - Launches sc.exe
    PID:5404
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "taskkill" /f /im AdAppMgrSvc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AdAppMgrSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "taskkill" /f /im AutodeskDesktopApp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AutodeskDesktopApp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "taskkill" /f /im AdskIdentityManager.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AdskIdentityManager.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "taskkill" /f /im "Autodesk Access UI Host.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "Autodesk Access UI Host.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "taskkill" /f /im "AdskAccessCore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "AdskAccessCore.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Autodesk Access" /f
  2⤵
  PID:3164
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" stop "Autodesk Access Service Host"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop "Autodesk Access Service Host"
    3⤵
    - Launches sc.exe
    PID:3152
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" config "Autodesk Access Service Host" start= demand
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config "Autodesk Access Service Host" start= demand
    3⤵
    - Launches sc.exe
    PID:404
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c "C:\Program Files\Autodesk\AdskIdentityManager\uninstall.exe" --mode unattended
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Autodesk\AdskIdentityManager\uninstall.exe" --mode unattended
    3⤵
    - Executes a command shell one-liner
    PID:4172
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended
    3⤵
    - Executes a command shell one-liner
    PID:3604
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c del /q /f "C:\Users\Admin\AppData\Local\Autodesk\Genuine Autodesk Service\id.dat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /q /f "C:\Users\Admin\AppData\Local\Autodesk\Genuine Autodesk Service\id.dat"
    3⤵
    PID:5884
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"
    3⤵
    - Executes a command shell one-liner
    PID:3716
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5468
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" stop AdskNLM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop AdskNLM
    3⤵
    - Launches sc.exe
    PID:4788
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\delnowmic.ps1'" )
  2⤵
  PID:248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\delnowmic.ps1'" )
    3⤵
    - Executes a command shell one-liner
    PID:5124
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4856
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"
  2⤵
  PID:2712
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"
    3⤵
    - Executes a command shell one-liner
    PID:3244
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11-19-4-1-ipv4-ipv6-win64.msi" TRANSFORMS=nlm.mst INSTALLFOLDER="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager" /qn
  2⤵
  PID:1056
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11-19-4-1-ipv4-ipv6-win64.msi" TRANSFORMS=nlm.mst INSTALLFOLDER="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager" /qn
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1528
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
  2⤵
  PID:5656
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
    3⤵
    - Executes a command shell one-liner
    PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:2116
  - - C:\Windows\system32\xcopy.exe
      xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
      4⤵
      Drops file in Program Files directory
      PID:1468
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
  2⤵
  PID:5360
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
    3⤵
    - Executes a command shell one-liner
    PID:3536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:1136
  - - C:\Windows\system32\xcopy.exe
      xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
      4⤵
      Drops file in Program Files directory
      PID:3164
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" create AdskNLM binPath= "\"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayname= AdskNLM
  2⤵
  PID:5032
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create AdskNLM binPath= "\"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayname= AdskNLM
    3⤵
    - Launches sc.exe
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
  2⤵
  PID:3652
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
    3⤵
    PID:4812
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
  2⤵
  PID:928
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
    3⤵
    PID:5164
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
  2⤵
  PID:2400
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
    3⤵
    PID:1740
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:3636
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:1552
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
  2⤵
  PID:5936
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
    3⤵
    PID:3144
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
  2⤵
  PID:1876
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
    3⤵
    PID:6060
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
  2⤵
  PID:4748
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
    3⤵
    PID:4928
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:1356
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:3976
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "27080@localhost" /f
  2⤵
  PID:4844
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "27080@localhost" /f
    3⤵
    PID:200
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADAOptIn" /t "REG_DWORD" /d "0" /f
  2⤵
  PID:1492
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADAOptIn" /t "REG_DWORD" /d "0" /f
    3⤵
    PID:5588
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADARePrompted" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:6124
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADARePrompted" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:1464
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2116
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "OverridedByHKLM" /t "REG_DWORD" /d "0" /f
  2⤵
  PID:4808
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "OverridedByHKLM" /t "REG_DWORD" /d "0" /f
    3⤵
    PID:5128
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"
  2⤵
  PID:2740
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"
    3⤵
    - Executes a command shell one-liner
    PID:2896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:4124
  - - C:\Windows\system32\xcopy.exe
      xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"
      4⤵
      PID:4672
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c find /c /i "genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^127.0.0.1 genuine-software.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:3248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^127.0.0.1 genuine-software.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:5000
  - - C:\Windows\system32\find.exe
      find /c /i "genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:5704
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c find /c /i "genuine-software1.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^127.0.0.1 genuine-software1.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:3312
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "genuine-software1.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^127.0.0.1 genuine-software1.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:2460
  - - C:\Windows\system32\find.exe
      find /c /i "genuine-software1.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:2644
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "cmd" /c find /c /i "genuine-software2.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^127.0.0.1 genuine-software2.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:4788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "genuine-software2.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^127.0.0.1 genuine-software2.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5164
  - - C:\Windows\system32\find.exe
      find /c /i "genuine-software2.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:1744
- C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Autodesk License Activator.exe" -sfxwaitall:0 "sc" start AdskNLM
  2⤵
  PID:4440
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start AdskNLM
    3⤵
    - Launches sc.exe
    PID:4780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2496
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A91F3463580FF0812DDC21CE83F88326
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA60E8847DA64403EF95A24691740C27
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9BC8416382B48B6C1394CF50D2D972CB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1176

C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
1⤵
- Executes dropped EXE
PID:2728
- C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
  "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" -z2
  2⤵
  - Executes dropped EXE
  PID:3932

C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
1⤵
- Executes dropped EXE
PID:4188
- C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
  "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" -c "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" -z -s
  2⤵
  - Executes dropped EXE
  PID:2052
- - C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe
    adskflex.exe -T Frptrmxs 11.19 -1 -c ";C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic;" -srv x6tfLojKYfWbGzn6Kr9B4Lzxwti2bM1dQgcjOSt2prgDQh94dhcF0j48Wa4hg2g --lmgrd_start 6a6c9f41 -vdrestart 0
    3⤵
    - Executes dropped EXE
    PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e59f73b.rbs

Path C:\Config.Msi\e59f73b.rbs
Size 9KB
SHA256 11df4965fa1df075651609f2f2d9ca620c074ce1ac1b72c3ead9d0b1d4d8fb89
MD5 aa01d04fda652c50c17acce75c1847f4
SHA1 bcafcb2cfce2fea02dfa7ffcdcba7da2ede6f361
SHA512 5ad719f75b232839ee1d77c5c37ef3bf619ee7bdd110eb2e677194b6d29b4d3744cde2641592db0511a041289a3dc3336aa0062e326e419ca96d6c8973a43fcc
SSDEEP 192:1C9393k3f3i3D3MphQdONCroUx2BIp5Ux2BVpIAduVYGpCtG:10Z4/6D+yKpWplXG
TLSH
T195124301BE4581FBEB661B36F34327817BB3C6C852545A2B08DC62386F523895FDE18B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.rtf

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.rtf
Size 99KB
SHA256 994dbb01d6e468706e7f783b609bc9948e05ddf55fb0c43333d55c09359064e8
MD5 db9b6d0f44bc811c52314bf36f6328b2
SHA1 0dbe841933f5cf468b42db7eb6b0aae88292300d
SHA512 5679169d9baf3654fcd1b73a46914f4cbfe37bc177b2fc8a9d711a71aca6d96bbb08b1645d26b0c5a2855a2a8bd1ac748e47c24b2832a134fd3d1c085df52941
SSDEEP 1536:VrXuOc6thM0uABFNA5IXmTtfTyOVe39Pb0kDsQ0sDL03LKLQa:Vrhth/BFUlyOVepbPD8sDQ3mv
TLSH
T1E1A3C7AB7A4513A716D602553F2744C7E329C53E3B6E57A820ADC00C13D3DB853BBADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseAdministration.pdf

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\LicenseAdministration.pdf
Size 2.8MB
SHA256 9a50fa1d2fde367fa21341364ca14836663a11057958743dfd8d661e311481b6
MD5 b2a5ae4e47d0af4c147e7e18fc2df586
SHA1 1488f395cb226c59ad79a1d44f0e6f4f04ad0183
SHA512 31093cb835bc9ab707c92877a9ccc5da54c725ca686917d0eece05a8444bb102027cc8b877b07010cc2550d3dcb4560b1bd6eb7efef8a2884289167de198de7e
SSDEEP 49152:m9ny+oK5zSSvGmG0Kkxgc3rslv5M/hcg9mP00e5dlJ0r+erN:mhl9QtpNc3ri5M/hcg0PpegaerN
TLSH
T153D51259FD168DA9F40D49B57F6A0132C28F71E06A0638D63B6C0F598703FB3B891AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adskflex.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe
Size 2.7MB
SHA256 f90c004a9803c4c7cb13541a03f96bda1fa3d0dd37591bdc0e71b53ccba5f725
MD5 b19c8acbaea67f6c2a05335beef3ee1f
SHA1 535885c94b3289263c1e0f6f2228463919179ea8
SHA512 cb3ca83c260a1d7bb101bb49198196668f7eb761f362c0f06c13233bec78a74694a8714af55497b9d0481c639d95da59a41628a03150f67db0429e98b2de55fb
SSDEEP 49152:CdYB1GImlDn5zqhW+HiZ+bUYwkLf+31sFt13d39Z:isNMB+H97Us3
TLSH
T1CCD56C42E25671F5F46BE279C6060627E6F6B8042334D7CF03B58B652F13BE09A7A349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmgrd.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
Size 1.3MB
SHA256 54c993ec37cdc90a8821edd3fc3fc44704c2de7a28db4efbb9f8a781b83cdbbf
MD5 5511d5d99c5b8d7c5147be9c0b4b9ba6
SHA1 87ecb85ee85857d8448b3dac3ae95128909cf2b6
SHA512 45600a7872381e1f75633406e2735d43f316ec715583de2555bc8ca35c09b2a77541135223362655b6208fa23da5184179ba1277d32cd1b43991c4b6ec84a44e
SSDEEP 24576:59UmzYaq3a3GafKMSSnGtuO3C+elDtfUP1zCjrj9f:LUh73aWanPGgO3ktfUm3
TLSH
T17B556C02E25372F6F46BD1B48655022BF2B978086334DBCF53648F666B27BD0E57A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmtools.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmtools.exe
Size 1.5MB
SHA256 899b30518b93ff451b4cc49e3d1b33f3a56909c430f4ad179825ca9a0b049593
MD5 58c91376ac43ef1e60a339c794132932
SHA1 50f8f91a31df2e3a6e86c0737f0e9e51953b3bcf
SHA512 8e7845874d8d5655a76bf28903e9ef7623ad976867e62bb60cc55fc2338ff198d8901de8b81c4c02ec75f5b87890687ab59cce467d48de1a5e653efc2537bc79
SSDEEP 24576:YneqIoW7GQDfh4bxIAFRJZVKCipSBa9iDtGJpnHtWeDaV:qVIoOt4bxIUhVASntGJzWaaV
TLSH
T152752982A26371E5FC2B91748F2D4233A6B57C085734DADB57A07F652B33B90A63B305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmutil.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmutil.exe
Size 1.4MB
SHA256 75d8c3fe59f5b9aaceb76e24fe1a44b805c65bbfcbfc489d66f9a479f1cf4425
MD5 795074805b95913a8edb4e7dcdd58715
SHA1 53f635038817c5866dd825897df87d21c8033310
SHA512 45f22452bf8d1aac0b658ce1afa57b014f4c9b14924110e03deb82474e84934d368be19e481b037c7f8a0e2e33835bd1dd38858c1f6b1ea0f1a9ed0558ee4edc
SSDEEP 24576:J86qTXb4vuiPCiYpY93L+cahGnX4dFBWeDtUHIoJwoMJ:mlL4WiPZYp+3L+cPno5tUHI+W
TLSH
T155658D02E26372F6F46BD1B5C6160223E6F5B8086734DBCB53A18F656B17BD0E53A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnNamed.json

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json
Size 408B
SHA256 e0371582686d18b48edb9e956057b52aa97de8c034ee79aab10ffb5331711651
MD5 ba3088f87edfcceb1e084c971db40601
SHA1 ca755bec6d224f4ff0f966e30824bcbb3f5f2f3f
SHA512 e2a61a4b5e160e85010dc195e0f86561b7479f388237af39bb9d0d1d07aa04320e3c71873f4aea40fb2e80c2803de994d5d87be07244705d0687dfb9833dad68
TLSH
T1E8E09220D9DD89EA22750174C661D412F00A672B42B86D0676FF732B5F3163018F0F5D
MD5 SHA1 SHA512 TLSH

Submit Download

adskflex.exe

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe
Size 2.7MB
SHA256 82be4ec8ba546ebf1e3448976d06e163e9c4e258301cfceb9ce8a2d76ecbd6ae
MD5 e974687b0135a662623056078a8e58e1
SHA1 d448155e737c544e1cce77fc44098809004b93e2
SHA512 0c08d1a59692be0d313cfe22384236adc849fa22310afc1e4c680be57058f643309b9db708080cd7e320e22b15e47d5588fd112ada7a0576b908e7ac8d58d8a6
SSDEEP 49152:CdYB1GImlDn5zqhW+HiZ+bUYwkLfA31sFt13d39Z:isNMB+H97Gs3
TLSH
T1B0D56C42E25671F5F46BE279C6060627E6F6B8042334D7CF03B58B652F13BE09A7A349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

licenses.lic

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic
Size 314KB
SHA256 e2e12a85c92f27abe966e8e9d3417ac9378c1b0f95f3a878003d684329876bfe
MD5 8d99725d0ed1db55523895e4cc9d0621
SHA1 8017ebc4988948ccd10226cb128b6e3b68b8733c
SHA512 0096e9ae1fc941158b76eaced3feecc08dd3a5a01ee12a5db787c106f899e4d60a7b2138f3042302de65252ce698da3bef97d17bbc8155028a37559697d3e26d
SSDEEP 384:psDCmvFOLTWmyYkpnXYQDqsB0KkQyxQvto/QhTD1lqChVNS5YhylGNMBFRRK1BTO:uX7mk8s418ubbI8JBejs
TLSH
T11B64DDED49477EE1249FF6B8BC344F3CA22D7698E6199240509B8E48B0A210DDDC7DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlm.mst

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm.mst
Size 20KB
SHA256 90e413cd675ee085c441df6327f6661a3459f4e109e0684b1a361c050d672bdb
MD5 29810bab1ef69a3d26872093ef09372b
SHA1 7909ffedce856814353a753bcf891085c4c0f03e
SHA512 f4c08df269e65accac37233cb6abe0d6c5ed6fa952bb11f4f77abaa628ef2301f85627fe3bf2a3a79d99f6dd841abe7629b74b13eab96cce48d1c82911d6f857
SSDEEP 24:J/m5WdOwBv+53YXjR7nfZXTaJPSKtqBdId9:ZmOOxKR7gJaT/69
TLSH
T186925C82BFA0C13AE5A446765F93C6DC5330FC40CEA2571734E6731F96722A02792312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlm11-19-4-1-ipv4-ipv6-win64.msi

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11-19-4-1-ipv4-ipv6-win64.msi
Size 8.2MB
SHA256 67ac43957233a6ebff216d0ff603b9d045583a6234c9a428f81b591b36a8fa71
MD5 bbd4394d0c1d30fbf9ad4715ff217821
SHA1 971916842f2d6cbbb1fb7cd266fc0d31dca40079
SHA512 d2c086d589997548b4d83da078cf52ef83b2f6ac4f7aa7604d5c07b7d3cb998b381ebaba252e0880edae7ea0cf17de8ef86f70b4a6104c0cb72123d401cac465
SSDEEP 196608:FKzAlbVnbWVpFWc84d8vjCo84blyCsd7pm6:FSA9ZbWVnWcWLnDyCsdd
TLSH
T16B86F142A15271E5EC6B91748F2E8633A675BC081734C6DF13E4BF6A2B33B90963B705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dll

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll
Size 73KB
SHA256 4739abff4da13a27f2421452007c9d2340bf4f9e9a601ef0ec9f1b9d64d1d365
MD5 44774fafd716fa45c7a0ccb3b14d59a6
SHA1 9de0f9b49e53a63757a181b235a3e18f6585b75b
SHA512 983bd89429c6dbe9ff94f5e4727982e580a4c696a81dab581be701be1600d8eb8bfa00b0e86b4c99bfe4f76ac11ba3bec8fe1138f864668c7ca9e6096c1222fd
SSDEEP 768:9p8U+GOaqL86X9eh5QUfHdwPI25VF0dRZraIMmckVPxIiTuj4B:ROa/p5NHdQ5VKJratmckVPxIiTucB
TLSH
T1F4736D4B72E0CCF9C46D8D3987A296D56D33F4E42326A3EB569D02CD0B8EAD05DF9250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF9F6.tmp

Path C:\Windows\Installer\MSIF9F6.tmp
Size 99KB
SHA256 b6861d25bde12b74229db3a4796cb9a529512042cde0bc5ad0121b0576d672e4
MD5 1dbd78917f6da40fcdf7078ef82e19b0
SHA1 7e9a89081db720025063330a78810021869393d9
SHA512 da46c5cb81e1b105bf51296513ae8ade8e35bb110895b3254b5241ccaff55cd5a7c3bfb93bd2d20c35222fce0649db96ca644a39934c1dfa35e9607cc03db6e6
SSDEEP 1536:aRJEiCPQANBFpSdUfTl/ACUeXycJTWdsWesQd09dlJsyI77tmxm:aRJEiq1HpkUrpTUeVlW+xMHsyIJ
TLSH
T1FBA36B5BA2E540ABE436863988A30E16E776F8111660CF6F0368465E1F773C25E3EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFA74.tmp

Path C:\Windows\Installer\MSIFA74.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 d82d05848d3f60c854a97f52f0043dac357f93ad23454f70340f5fe33f5dfc99
MD5 6e0bfdec79295a777267274fe673e82d
SHA1 a9bd2e3dee33233cf7372f36cfb9e984fbe09935
SHA512 eed1eacbe59d2f80aca39b73146471e6791c2dc0d5e6d8d035b2ef271b518750d83c1dfe93e0dcbc0870171b8d4804d32730f715839bbcf2a916fc0294963527
TLSH
T11221BB260649915D26B342E5092CB42FA31FD4EF0E2B8DCD3E8E450F7BA2A0C5336646
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9c13cb16da6b07171936df880c623e3ff0353c728cba0cd7807355533cfb1c73
MD5 2459fbe42295f18336af3bd9e3def082
SHA1 6c19e97ff132932ccd9e39ac6141e2582291be4e
SHA512 71bb7cb26802e0ad659d92378f1434a116a405a1e4640117813bcda5dc9cfbb449cf0b140efd4ee6b69aa6361075ecc05c106c0b2ac16b8d5e4cfdbe0e4f62b9
TLSH
T1A7219B260649915D26F342D50928B42FE35FD5EB0E2F8DCD3E8D450F7BA2A0C5376646
MD5 SHA1 SHA512 TLSH

Submit Download