11278f027b9277fde2cb0053befdcc5541adb68418114ffe53de41b7a3f9dc97

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AdskNLM.exe
Size 7.4MB
Sample260803-camaysae97
SHA256 11278f027b9277fde2cb0053befdcc5541adb68418114ffe53de41b7a3f9dc97
MD5 4f6b4ee233bcd37d890e86eaad26bab0
SHA1 902dfd6053c1de5f68fe01e14de15e0b3a2ca21c
SHA512 acd6923a646238535d60530148f10b2e8c3c3008274c07584f49dc0d007add80c946fc231f668f5de04648241aa223a5f46caaf9d973203121aa7a4a10aad3f0
SSDEEP 196608:uWU+phJYDNAHmXiqKmqQeyLKpRdcVtXOnc:u8jqDNAGXiTmrMpwVVgc
TLSH
T1AA763312767598D6E8664E348AA3D924E27E7C617760D2D330593FFD0933AC46F3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
424	lmgrd.exe
2380	lmgrd.exe
5792	lmgrd.exe
4772	lmgrd.exe
5236	adskflex.exe

Loads dropped DLL 5 IoCs

pid	Process
4468	MsiExec.exe
6120	MsiExec.exe
6120	MsiExec.exe
6120	MsiExec.exe
5604	MsiExec.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\version.dll	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.rtf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\LicenseAdministration.pdf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmtools.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmutil.exe	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI738.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a03ba.msi	msiexec.exe
File created	C:\Windows\Installer\e5a03bb.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC7F84DF5B564B7C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI727.tmp	msiexec.exe
File created	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e5a03bf.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B6.tmp	msiexec.exe
File created	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\nlm.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E4ACC4E7A206364.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a03bb.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6D40E79C7454DB0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\lmtools.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\lmtools.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{4BE91685-1632-47FC-B563-A8A542C6664C}\nlm.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBFB7A984CA2589CE.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a03ba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4BE91685-1632-47FC-B563-A8A542C6664C}	msiexec.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1172	sc.exe
3896	sc.exe
1640	sc.exe
4204	sc.exe
2544	sc.exe
2516	sc.exe
2552	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5984	cmd.exe
5428	cmd.exe
3924	cmd.exe
5572	cmd.exe
1020	cmd.exe
1484	cmd.exe
1016	cmd.exe
5772	cmd.exe
5396	cmd.exe
3704	cmd.exe
1376	cmd.exe
5016	cmd.exe
5308	cmd.exe
5324	cmd.exe
120	cmd.exe
1576	cmd.exe
4268	cmd.exe
4388	cmd.exe
3204	cmd.exe
4196	cmd.exe
4988	cmd.exe
5400	cmd.exe
5304	cmd.exe
6068	cmd.exe
5412	cmd.exe
848	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2360	ipconfig.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1988	taskkill.exe
1352	taskkill.exe
2596	taskkill.exe
4088	taskkill.exe
2064	taskkill.exe
2060	taskkill.exe
4580	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Adsk-NLM\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\PackageCode = "55B98EBBBAF085F4D8632D5C58260AF6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\ProductIcon = "C:\\Windows\\Installer\\{4BE91685-1632-47FC-B563-A8A542C6664C}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4BC698D839589114AA143BB5C9D87F42\58619EB42361CF745B368A5A246C66C4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\PackageName = "nlm11-19-4-1-ipv4-ipv6-win64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adsk-NLM\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\58619EB42361CF745B368A5A246C66C4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\ProductName = "Autodesk Network License Manager"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Version = "185794564"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Transforms = "C:\\Windows\\Installer\\{4BE91685-1632-47FC-B563-A8A542C6664C}\\nlm.mst"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\58619EB42361CF745B368A5A246C66C4\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58619EB42361CF745B368A5A246C66C4\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4BC698D839589114AA143BB5C9D87F42	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2816	WMIC.exe
2816	WMIC.exe
2816	WMIC.exe
2816	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
6124	WMIC.exe
6124	WMIC.exe
6124	WMIC.exe
6124	WMIC.exe
1936	msiexec.exe
1936	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
804	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	2060	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2816	WMIC.exe
Token: SeSecurityPrivilege	2816	WMIC.exe
Token: SeTakeOwnershipPrivilege	2816	WMIC.exe
Token: SeLoadDriverPrivilege	2816	WMIC.exe
Token: SeSystemProfilePrivilege	2816	WMIC.exe
Token: SeSystemtimePrivilege	2816	WMIC.exe
Token: SeProfSingleProcessPrivilege	2816	WMIC.exe
Token: SeIncBasePriorityPrivilege	2816	WMIC.exe
Token: SeCreatePagefilePrivilege	2816	WMIC.exe
Token: SeBackupPrivilege	2816	WMIC.exe
Token: SeRestorePrivilege	2816	WMIC.exe
Token: SeShutdownPrivilege	2816	WMIC.exe
Token: SeDebugPrivilege	2816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2816	WMIC.exe
Token: SeRemoteShutdownPrivilege	2816	WMIC.exe
Token: SeUndockPrivilege	2816	WMIC.exe
Token: SeManageVolumePrivilege	2816	WMIC.exe
Token: 33	2816	WMIC.exe
Token: 34	2816	WMIC.exe
Token: 35	2816	WMIC.exe
Token: 36	2816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2816	WMIC.exe
Token: SeSecurityPrivilege	2816	WMIC.exe
Token: SeTakeOwnershipPrivilege	2816	WMIC.exe
Token: SeLoadDriverPrivilege	2816	WMIC.exe
Token: SeSystemProfilePrivilege	2816	WMIC.exe
Token: SeSystemtimePrivilege	2816	WMIC.exe
Token: SeProfSingleProcessPrivilege	2816	WMIC.exe
Token: SeIncBasePriorityPrivilege	2816	WMIC.exe
Token: SeCreatePagefilePrivilege	2816	WMIC.exe
Token: SeBackupPrivilege	2816	WMIC.exe
Token: SeRestorePrivilege	2816	WMIC.exe
Token: SeShutdownPrivilege	2816	WMIC.exe
Token: SeDebugPrivilege	2816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2816	WMIC.exe
Token: SeRemoteShutdownPrivilege	2816	WMIC.exe
Token: SeUndockPrivilege	2816	WMIC.exe
Token: SeManageVolumePrivilege	2816	WMIC.exe
Token: 33	2816	WMIC.exe
Token: 34	2816	WMIC.exe
Token: 35	2816	WMIC.exe
Token: 36	2816	WMIC.exe
Token: SeSecurityPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2396	WMIC.exe
Token: SeSecurityPrivilege	2396	WMIC.exe
Token: SeTakeOwnershipPrivilege	2396	WMIC.exe
Token: SeLoadDriverPrivilege	2396	WMIC.exe
Token: SeSystemProfilePrivilege	2396	WMIC.exe
Token: SeSystemtimePrivilege	2396	WMIC.exe
Token: SeProfSingleProcessPrivilege	2396	WMIC.exe
Token: SeIncBasePriorityPrivilege	2396	WMIC.exe
Token: SeCreatePagefilePrivilege	2396	WMIC.exe
Token: SeBackupPrivilege	2396	WMIC.exe
Token: SeRestorePrivilege	2396	WMIC.exe
Token: SeShutdownPrivilege	2396	WMIC.exe
Token: SeDebugPrivilege	2396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2396	WMIC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1936	msiexec.exe
5704	msiexec.exe
4468	MsiExec.exe
6120	MsiExec.exe
5604	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 5116	2652	AdskNLM.exe	89
PID 5116 wrote to memory of 2544	5116	AdskNLM.exe	90
PID 2652 wrote to memory of 4256	2652	AdskNLM.exe	92
PID 4256 wrote to memory of 4088	4256	AdskNLM.exe	93
PID 2652 wrote to memory of 124	2652	AdskNLM.exe	96
PID 124 wrote to memory of 1376	124	AdskNLM.exe	97
PID 1376 wrote to memory of 4964	1376	cmd.exe	99
PID 1376 wrote to memory of 3120	1376	cmd.exe	100
PID 2652 wrote to memory of 5884	2652	AdskNLM.exe	101
PID 5884 wrote to memory of 6068	5884	AdskNLM.exe	102
PID 2652 wrote to memory of 4168	2652	AdskNLM.exe	104
PID 4168 wrote to memory of 1576	4168	AdskNLM.exe	105
PID 2652 wrote to memory of 1124	2652	AdskNLM.exe	107
PID 1124 wrote to memory of 4268	1124	AdskNLM.exe	108
PID 2652 wrote to memory of 4484	2652	AdskNLM.exe	110
PID 4484 wrote to memory of 5412	4484	AdskNLM.exe	111
PID 2652 wrote to memory of 1568	2652	AdskNLM.exe	113
PID 1568 wrote to memory of 848	1568	AdskNLM.exe	114
PID 2652 wrote to memory of 3776	2652	AdskNLM.exe	116
PID 3776 wrote to memory of 4388	3776	AdskNLM.exe	117
PID 2652 wrote to memory of 1676	2652	AdskNLM.exe	119
PID 1676 wrote to memory of 5016	1676	AdskNLM.exe	120
PID 2652 wrote to memory of 700	2652	AdskNLM.exe	122
PID 700 wrote to memory of 3204	700	AdskNLM.exe	123
PID 2652 wrote to memory of 4864	2652	AdskNLM.exe	125
PID 4864 wrote to memory of 1484	4864	AdskNLM.exe	126
PID 2652 wrote to memory of 1416	2652	AdskNLM.exe	128
PID 1416 wrote to memory of 2516	1416	AdskNLM.exe	129
PID 2652 wrote to memory of 5752	2652	AdskNLM.exe	131
PID 5752 wrote to memory of 2064	5752	AdskNLM.exe	132
PID 2652 wrote to memory of 1660	2652	AdskNLM.exe	134
PID 1660 wrote to memory of 2060	1660	AdskNLM.exe	135
PID 2652 wrote to memory of 2244	2652	AdskNLM.exe	137
PID 2244 wrote to memory of 4580	2244	AdskNLM.exe	138
PID 2652 wrote to memory of 3760	2652	AdskNLM.exe	140
PID 3760 wrote to memory of 1988	3760	AdskNLM.exe	141
PID 2652 wrote to memory of 2428	2652	AdskNLM.exe	143
PID 2428 wrote to memory of 1352	2428	AdskNLM.exe	144
PID 2652 wrote to memory of 5372	2652	AdskNLM.exe	146
PID 5372 wrote to memory of 2596	5372	AdskNLM.exe	147
PID 2652 wrote to memory of 1364	2652	AdskNLM.exe	149
PID 2652 wrote to memory of 5788	2652	AdskNLM.exe	151
PID 2652 wrote to memory of 4496	2652	AdskNLM.exe	152
PID 4496 wrote to memory of 2552	4496	AdskNLM.exe	154
PID 2652 wrote to memory of 3196	2652	AdskNLM.exe	156
PID 3196 wrote to memory of 1172	3196	AdskNLM.exe	157
PID 2652 wrote to memory of 5716	2652	AdskNLM.exe	159
PID 5716 wrote to memory of 1016	5716	AdskNLM.exe	160
PID 2652 wrote to memory of 1008	2652	AdskNLM.exe	162
PID 1008 wrote to memory of 5772	1008	AdskNLM.exe	163
PID 2652 wrote to memory of 3376	2652	AdskNLM.exe	165
PID 3376 wrote to memory of 5984	3376	AdskNLM.exe	166
PID 5984 wrote to memory of 2816	5984	cmd.exe	168
PID 2652 wrote to memory of 1460	2652	AdskNLM.exe	171
PID 1460 wrote to memory of 4656	1460	AdskNLM.exe	172
PID 2652 wrote to memory of 5840	2652	AdskNLM.exe	174
PID 5840 wrote to memory of 5428	5840	AdskNLM.exe	175
PID 2652 wrote to memory of 5956	2652	AdskNLM.exe	177
PID 5956 wrote to memory of 4196	5956	AdskNLM.exe	178
PID 4196 wrote to memory of 2396	4196	cmd.exe	180
PID 2652 wrote to memory of 4412	2652	AdskNLM.exe	182
PID 4412 wrote to memory of 3896	4412	AdskNLM.exe	183
PID 2652 wrote to memory of 5100	2652	AdskNLM.exe	185
PID 5100 wrote to memory of 4988	5100	AdskNLM.exe	186

C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" stop AdskLicensingService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop AdskLicensingService
    3⤵
    - Launches sc.exe
    PID:2544
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /im AdskLicensingAgent.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /im AdskLicensingAgent.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:4964
  - - C:\Windows\system32\xcopy.exe
      xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
      4⤵
      Drops file in Program Files directory
      PID:3120
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.1.66\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:1576
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.2.0.4231\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:4268
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:5412
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.0.5629\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:848
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.1.1.17\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:4388
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:5016
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.0.1.5\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:3204
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\version.dll" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version_old.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\version.dll" )
    3⤵
    - Executes a command shell one-liner
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" start AdskLicensingService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start AdskLicensingService
    3⤵
    - Launches sc.exe
    PID:2516
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im AdAppMgrSvc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AdAppMgrSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im AutodeskDesktopApp.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AutodeskDesktopApp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im AdskIdentityManager.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im AdskIdentityManager.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im "Autodesk Access UI Host.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "Autodesk Access UI Host.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im "AdskAccessCore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "AdskAccessCore.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im "AdskAccessService.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "AdskAccessService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Autodesk Access Service" /f
  2⤵
  PID:1364
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Autodesk Access" /f
  2⤵
  PID:5788
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" stop "Autodesk Access Service Host"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop "Autodesk Access Service Host"
    3⤵
    - Launches sc.exe
    PID:2552
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" config "Autodesk Access Service Host" start= demand
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config "Autodesk Access Service Host" start= demand
    3⤵
    - Launches sc.exe
    PID:1172
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c "C:\Program Files\Autodesk\AdskIdentityManager\uninstall.exe" --mode unattended
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Autodesk\AdskIdentityManager\uninstall.exe" --mode unattended
    3⤵
    - Executes a command shell one-liner
    PID:1016
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended
    3⤵
    - Executes a command shell one-liner
    PID:5772
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c del /q /f "C:\Users\Admin\AppData\Local\Autodesk\Genuine Autodesk Service\id.dat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /q /f "C:\Users\Admin\AppData\Local\Autodesk\Genuine Autodesk Service\id.dat"
    3⤵
    PID:4656
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"
    3⤵
    - Executes a command shell one-liner
    PID:5428
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2396
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" stop AdskNLM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop AdskNLM
    3⤵
    - Launches sc.exe
    PID:3896
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\delnowmic.ps1'" )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\delnowmic.ps1'" )
    3⤵
    - Executes a command shell one-liner
    PID:4988
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6124
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"
  2⤵
  PID:3272
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"
    3⤵
    - Executes a command shell one-liner
    PID:5400
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11-19-4-1-ipv4-ipv6-win64.msi" TRANSFORMS=nlm.mst INSTALLFOLDER="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager" /qn
  2⤵
  PID:5616
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11-19-4-1-ipv4-ipv6-win64.msi" TRANSFORMS=nlm.mst INSTALLFOLDER="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager" /qn
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
  2⤵
  PID:5496
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
    3⤵
    - Executes a command shell one-liner
    PID:3924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:5300
  - - C:\Windows\system32\xcopy.exe
      xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
      4⤵
      Drops file in Program Files directory
      PID:3944
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
  2⤵
  PID:3240
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
    3⤵
    - Executes a command shell one-liner
    PID:5304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:260
  - - C:\Windows\system32\xcopy.exe
      xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"
      4⤵
      Drops file in Program Files directory
      PID:2144
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" create AdskNLM binPath= "\"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayname= AdskNLM
  2⤵
  PID:1364
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create AdskNLM binPath= "\"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayname= AdskNLM
    3⤵
    - Launches sc.exe
    PID:1640
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\Autodesk\ODIS" /v "DisableAutoUpdate" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:2732
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Autodesk\ODIS" /v "DisableAutoUpdate" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:2572
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
  2⤵
  PID:8
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
  2⤵
  PID:3168
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
    3⤵
    PID:1996
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
  2⤵
  PID:1528
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
    3⤵
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:1188
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
  2⤵
  PID:5552
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f
    3⤵
    PID:5764
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
  2⤵
  PID:6060
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f
    3⤵
    PID:1492
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
  2⤵
  PID:3364
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
    3⤵
    PID:2936
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:2948
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:4728
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" delete "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /f
  2⤵
  PID:5192
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /f
    3⤵
    PID:5384
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "27080@localhost" /f
  2⤵
  PID:2264
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "27080@localhost" /f
    3⤵
    PID:1504
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADAOptIn" /t "REG_DWORD" /d "0" /f
  2⤵
  PID:2516
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADAOptIn" /t "REG_DWORD" /d "0" /f
    3⤵
    PID:5804
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADARePrompted" /t "REG_DWORD" /d "1" /f
  2⤵
  PID:3388
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADARePrompted" /t "REG_DWORD" /d "1" /f
    3⤵
    PID:5004
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "OverridedByHKLM" /t "REG_DWORD" /d "0" /f
  2⤵
  PID:4532
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "OverridedByHKLM" /t "REG_DWORD" /d "0" /f
    3⤵
    PID:4860
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"
  2⤵
  PID:5432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo D | xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"
    3⤵
    - Executes a command shell one-liner
    PID:5308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo D "
      4⤵
      PID:3920
  - - C:\Windows\system32\xcopy.exe
      xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"
      4⤵
      PID:6020
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c find /c /i "genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 genuine-software.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:4056
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 genuine-software.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:5572
  - - C:\Windows\system32\find.exe
      find /c /i "genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:6008
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c find /c /i "genuine-software1.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 genuine-software1.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:4832
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "genuine-software1.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 genuine-software1.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:1020
  - - C:\Windows\system32\find.exe
      find /c /i "genuine-software1.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:928
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c find /c /i "genuine-software2.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 genuine-software2.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:4432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "genuine-software2.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 genuine-software2.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:5324
  - - C:\Windows\system32\find.exe
      find /c /i "genuine-software2.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:5608
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c find /c /i "api.genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 api.genuine-software.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:3164
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "api.genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 api.genuine-software.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:5396
  - - C:\Windows\system32\find.exe
      find /c /i "api.genuine-software.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:2752
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c find /c /i "ase-cdn-stg.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 api.ase-cdn-stg.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:2556
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c find /c /i "ase-cdn-stg.autodesk.com" "C:\Windows\system32\drivers\etc\hosts" || echo ^0.0.0.0 api.ase-cdn-stg.autodesk.com >> "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    PID:120
  - - C:\Windows\system32\find.exe
      find /c /i "ase-cdn-stg.autodesk.com" "C:\Windows\system32\drivers\etc\hosts"
      4⤵
      PID:5776
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c ipconfig /flushdns
  2⤵
  PID:2880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /flushdns
    3⤵
    - Executes a command shell one-liner
    PID:3704
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:2360
- C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe
  "C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" start AdskNLM
  2⤵
  PID:5864
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start AdskNLM
    3⤵
    - Launches sc.exe
    PID:4204

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1936
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 14282543B76B8E49449B12FD6F7A0785
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F372446D187C9A1762508EE0F700334
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7A45AF8C170EC1880F4DEA5D3E6CDEE5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5604

C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
1⤵
- Executes dropped EXE
PID:424
- C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
  "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" -z2
  2⤵
  - Executes dropped EXE
  PID:2380

C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
1⤵
- Executes dropped EXE
PID:5792
- C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
  "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" -c "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" -z -s
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe
    adskflex.exe -T Oaggwfqt 11.19 -1 -c ";C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic;" -srv UZBmW2FVWZZthvx7A0iKV9Qqp4x4ocqHCxuslXFp6aWmUXiTtkllwnujrfVGtiW --lmgrd_start 6a6ff4ad -vdrestart 0
    3⤵
    - Executes dropped EXE
    PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e5a03be.rbs

Path C:\Config.Msi\e5a03be.rbs
Size 9KB
SHA256 e17eb05c7c973e9a2b1bdbe18109820dfe719029ad722ea3c64da20d3241dbef
MD5 9e38e56492d5d6508de9118e2c331d62
SHA1 5ddfe3d77c2eaabdbfde205a97488470b334e6b3
SHA512 d0ddb28b79be964e3a5d2d42339be6943fab8f7cb7a0f7ded8b49bd70922080b2fce4d3255380e5546736df0de88fa0667320a57f71ad62b1b33fec46a8a1426
SSDEEP 192:nC9393k3f3i3D3MphQdONCzoIx2BIp5Ix2BVpIAduVYGpCt9:n0Z4/6D+yO1W1lX9
TLSH
T1A7124401BE4581FBEB661B76F34327817BB3C6C852545A2B08DC62385F523889FDE18B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.rtf

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.rtf
Size 99KB
SHA256 994dbb01d6e468706e7f783b609bc9948e05ddf55fb0c43333d55c09359064e8
MD5 db9b6d0f44bc811c52314bf36f6328b2
SHA1 0dbe841933f5cf468b42db7eb6b0aae88292300d
SHA512 5679169d9baf3654fcd1b73a46914f4cbfe37bc177b2fc8a9d711a71aca6d96bbb08b1645d26b0c5a2855a2a8bd1ac748e47c24b2832a134fd3d1c085df52941
SSDEEP 1536:VrXuOc6thM0uABFNA5IXmTtfTyOVe39Pb0kDsQ0sDL03LKLQa:Vrhth/BFUlyOVepbPD8sDQ3mv
TLSH
T1E1A3C7AB7A4513A716D602553F2744C7E329C53E3B6E57A820ADC00C13D3DB853BBADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseAdministration.pdf

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\LicenseAdministration.pdf
Size 2.8MB
SHA256 9a50fa1d2fde367fa21341364ca14836663a11057958743dfd8d661e311481b6
MD5 b2a5ae4e47d0af4c147e7e18fc2df586
SHA1 1488f395cb226c59ad79a1d44f0e6f4f04ad0183
SHA512 31093cb835bc9ab707c92877a9ccc5da54c725ca686917d0eece05a8444bb102027cc8b877b07010cc2550d3dcb4560b1bd6eb7efef8a2884289167de198de7e
SSDEEP 49152:m9ny+oK5zSSvGmG0Kkxgc3rslv5M/hcg9mP00e5dlJ0r+erN:mhl9QtpNc3ri5M/hcg0PpegaerN
TLSH
T153D51259FD168DA9F40D49B57F6A0132C28F71E06A0638D63B6C0F598703FB3B891AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adskflex.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe
Size 2.7MB
SHA256 f90c004a9803c4c7cb13541a03f96bda1fa3d0dd37591bdc0e71b53ccba5f725
MD5 b19c8acbaea67f6c2a05335beef3ee1f
SHA1 535885c94b3289263c1e0f6f2228463919179ea8
SHA512 cb3ca83c260a1d7bb101bb49198196668f7eb761f362c0f06c13233bec78a74694a8714af55497b9d0481c639d95da59a41628a03150f67db0429e98b2de55fb
SSDEEP 49152:CdYB1GImlDn5zqhW+HiZ+bUYwkLf+31sFt13d39Z:isNMB+H97Us3
TLSH
T1CCD56C42E25671F5F46BE279C6060627E6F6B8042334D7CF03B58B652F13BE09A7A349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmgrd.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
Size 1.3MB
SHA256 54c993ec37cdc90a8821edd3fc3fc44704c2de7a28db4efbb9f8a781b83cdbbf
MD5 5511d5d99c5b8d7c5147be9c0b4b9ba6
SHA1 87ecb85ee85857d8448b3dac3ae95128909cf2b6
SHA512 45600a7872381e1f75633406e2735d43f316ec715583de2555bc8ca35c09b2a77541135223362655b6208fa23da5184179ba1277d32cd1b43991c4b6ec84a44e
SSDEEP 24576:59UmzYaq3a3GafKMSSnGtuO3C+elDtfUP1zCjrj9f:LUh73aWanPGgO3ktfUm3
TLSH
T17B556C02E25372F6F46BD1B48655022BF2B978086334DBCF53648F666B27BD0E57A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmtools.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmtools.exe
Size 1.5MB
SHA256 899b30518b93ff451b4cc49e3d1b33f3a56909c430f4ad179825ca9a0b049593
MD5 58c91376ac43ef1e60a339c794132932
SHA1 50f8f91a31df2e3a6e86c0737f0e9e51953b3bcf
SHA512 8e7845874d8d5655a76bf28903e9ef7623ad976867e62bb60cc55fc2338ff198d8901de8b81c4c02ec75f5b87890687ab59cce467d48de1a5e653efc2537bc79
SSDEEP 24576:YneqIoW7GQDfh4bxIAFRJZVKCipSBa9iDtGJpnHtWeDaV:qVIoOt4bxIUhVASntGJzWaaV
TLSH
T152752982A26371E5FC2B91748F2D4233A6B57C085734DADB57A07F652B33B90A63B305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmutil.exe

Path C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmutil.exe
Size 1.4MB
SHA256 75d8c3fe59f5b9aaceb76e24fe1a44b805c65bbfcbfc489d66f9a479f1cf4425
MD5 795074805b95913a8edb4e7dcdd58715
SHA1 53f635038817c5866dd825897df87d21c8033310
SHA512 45f22452bf8d1aac0b658ce1afa57b014f4c9b14924110e03deb82474e84934d368be19e481b037c7f8a0e2e33835bd1dd38858c1f6b1ea0f1a9ed0558ee4edc
SSDEEP 24576:J86qTXb4vuiPCiYpY93L+cahGnX4dFBWeDtUHIoJwoMJ:mlL4WiPZYp+3L+cPno5tUHI+W
TLSH
T155658D02E26372F6F46BD1B5C6160223E6F5B8086734DBCB53A18F656B17BD0E53A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnNamed.json

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json
Size 408B
SHA256 e0371582686d18b48edb9e956057b52aa97de8c034ee79aab10ffb5331711651
MD5 ba3088f87edfcceb1e084c971db40601
SHA1 ca755bec6d224f4ff0f966e30824bcbb3f5f2f3f
SHA512 e2a61a4b5e160e85010dc195e0f86561b7479f388237af39bb9d0d1d07aa04320e3c71873f4aea40fb2e80c2803de994d5d87be07244705d0687dfb9833dad68
TLSH
T1E8E09220D9DD89EA22750174C661D412F00A672B42B86D0676FF732B5F3163018F0F5D
MD5 SHA1 SHA512 TLSH

Submit Download

adskflex.exe

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe
Size 2.7MB
SHA256 82be4ec8ba546ebf1e3448976d06e163e9c4e258301cfceb9ce8a2d76ecbd6ae
MD5 e974687b0135a662623056078a8e58e1
SHA1 d448155e737c544e1cce77fc44098809004b93e2
SHA512 0c08d1a59692be0d313cfe22384236adc849fa22310afc1e4c680be57058f643309b9db708080cd7e320e22b15e47d5588fd112ada7a0576b908e7ac8d58d8a6
SSDEEP 49152:CdYB1GImlDn5zqhW+HiZ+bUYwkLfA31sFt13d39Z:isNMB+H97Gs3
TLSH
T1B0D56C42E25671F5F46BE279C6060627E6F6B8042334D7CF03B58B652F13BE09A7A349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

licenses.lic

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\licenses.lic
Size 364KB
SHA256 0c6f0471de81c57aaa68914d0d97418fcd96f96b8a9bdb1bcb700f9a5fe24aa6
MD5 f4a3e9f9696df0c3361eebed5ebfbe66
SHA1 b0dbec874258a8a71325c1eb65b3d65e55034d9e
SHA512 b071f0fbd7ba19d571fac6850705102888a8480f4904521d1015d2f434a8c2b33031f927e37c5973a9b7f9ef7a8f53d3d02eea3f68d6e21847de30e396128563
SSDEEP 384:OZG2CfV0B8vXhfBxXkpg7U7V6MWdVj2fgs1IWCscyQkF8cq8dsIG6FjVjntDqGq0:gUck+kI6SjwuFdK03dq/I
TLSH
T18B840D87D3D38F992487EBC1189D2B3EE1E4277D25B1D61314784EC8B1EB58694C2CEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlm.mst

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm.mst
Size 20KB
SHA256 90e413cd675ee085c441df6327f6661a3459f4e109e0684b1a361c050d672bdb
MD5 29810bab1ef69a3d26872093ef09372b
SHA1 7909ffedce856814353a753bcf891085c4c0f03e
SHA512 f4c08df269e65accac37233cb6abe0d6c5ed6fa952bb11f4f77abaa628ef2301f85627fe3bf2a3a79d99f6dd841abe7629b74b13eab96cce48d1c82911d6f857
SSDEEP 24:J/m5WdOwBv+53YXjR7nfZXTaJPSKtqBdId9:ZmOOxKR7gJaT/69
TLSH
T186925C82BFA0C13AE5A446765F93C6DC5330FC40CEA2571734E6731F96722A02792312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlm11-19-4-1-ipv4-ipv6-win64.msi

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11-19-4-1-ipv4-ipv6-win64.msi
Size 8.2MB
SHA256 67ac43957233a6ebff216d0ff603b9d045583a6234c9a428f81b591b36a8fa71
MD5 bbd4394d0c1d30fbf9ad4715ff217821
SHA1 971916842f2d6cbbb1fb7cd266fc0d31dca40079
SHA512 d2c086d589997548b4d83da078cf52ef83b2f6ac4f7aa7604d5c07b7d3cb998b381ebaba252e0880edae7ea0cf17de8ef86f70b4a6104c0cb72123d401cac465
SSDEEP 196608:FKzAlbVnbWVpFWc84d8vjCo84blyCsd7pm6:FSA9ZbWVnWcWLnDyCsdd
TLSH
T16B86F142A15271E5EC6B91748F2E8633A675BC081734C6DF13E4BF6A2B33B90963B705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dll

Path C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\version.dll
Size 73KB
SHA256 c6a4426b196f19b0a456908b20a1b5fa6d2dae8cdb1ee7bc537f2842014ba6db
MD5 4c059805319a0bb6830c563e41d85918
SHA1 569cbf5401de4c378e7aac030c94430daef57b62
SHA512 e12a6ac84aa6a96965a092f09fcc7711ff3553c64b620a595ba1f1726377f7356e97d0ffa0dc8759d8217fd67a18b312e8c37c6441bbe9c438596742a0ad6b07
SSDEEP 768:np8U+GOaqL86X9eh5QUfHdwPI25VR0dRZraIMmckVPxIiT4j4B:rOa/p5NHdQ5VmJratmckVPxIiT4cB
TLSH
T171736D4B72E0CCF9C46D8D3987A296D56D33F4E41326A3EB569D02CD0B8EAD09DF9240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI57F.tmp

Path C:\Windows\Installer\MSI57F.tmp
Size 99KB
SHA256 b6861d25bde12b74229db3a4796cb9a529512042cde0bc5ad0121b0576d672e4
MD5 1dbd78917f6da40fcdf7078ef82e19b0
SHA1 7e9a89081db720025063330a78810021869393d9
SHA512 da46c5cb81e1b105bf51296513ae8ade8e35bb110895b3254b5241ccaff55cd5a7c3bfb93bd2d20c35222fce0649db96ca644a39934c1dfa35e9607cc03db6e6
SSDEEP 1536:aRJEiCPQANBFpSdUfTl/ACUeXycJTWdsWesQd09dlJsyI77tmxm:aRJEiq1HpkUrpTUeVlW+xMHsyIJ
TLSH
T1FBA36B5BA2E540ABE436863988A30E16E776F8111660CF6F0368465E1F773C25E3EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5DE.tmp

Path C:\Windows\Installer\MSI5DE.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 89efd1755623e9a2790796203f560fdb39fe89ec6879f7c6bde4b710e556aa05
MD5 0bb03e00e363035dc54f0c5b068bc203
SHA1 d817a3f5a301eef9b5d1abea39ac10307c6528bb
SHA512 b4f72e92348d78f08fcad5d87dd877a13c48e6a45be4064bb49689a864915dda9bbd9f4cd7af5bc79ab08cf826c1108f1b5717a59caebc26689f77c022a3d938
TLSH
T15921BB260649915D26B342E5092CB42FA31FD4EB0A2B8DCD3E8E450F7BA2A1C5337646
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 0ad0fc4efd23b0cf964c2fe9cec0c4c28eb6647b49741a4370dd6e0ed22eeaff
MD5 504deec104e3337c8dd25d5ae2fd1226
SHA1 e73fe504e0c29d829421951b755b4122c12850d7
SHA512 8072c33b8643791af79bb09b595943e29ba5e56df727239b2776eee1eb5441f776f50e3c234718c7a1591338f13a7efaa3a5e834ed87954e502a9cab1d534a29
TLSH
T1AD21CB260649915D26B342D5492CB42FE31FD4EB0A2F8DCD3E8D450F7BA2A1C6333646
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 578d5bb0c3d32cee654b84ff37e5ece0b099a4bf66d835fee65e5bdd0f37afee
MD5 8339b83c5798a35c235af791b2b5492a
SHA1 7311bb14fb343fd665ad46e3d58c9757f466d035
SHA512 75b4fd96b39deff4c4216e895b171131949841fc6a3d8313bac7f7f5e788ff99911705215d91e73b9e0b9cc949029fccba9dd17253f42f7ce48c1931f7ca771c
TLSH
T10921DC260645919C26B302D5452CB42FF31FD4EB0A6F8DCD3E8D050F7BA1A1C2333646
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ce6f66fb060593e5dc0b2bb551b77d1e36c3a2c286e3afa029ed70678ef5678a
MD5 7c5bd0568d542de2da39c43d1ee83fa4
SHA1 34abcc3bffe541b55898d227b108296822917646
SHA512 2695541bc5b8c0727a2f03089b26fdb874aa0c9444cfcd18d3ca9ee103c47238beb77c8e9ba0ce71c7087bfb59f6d4c216dbf2e1af2bf662a1f86514995ca2b5
TLSH
T1BA21ED260645529C25B302D0452CB42EF30FD4EB0A6F8DCD3F8D060E7BA161C2373246
MD5 SHA1 SHA512 TLSH

Submit Download