23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T538,Found string "zlib compression" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "run length compression" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "sslv3 alert decompression failure" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "no compression specified" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "duplicate compression id" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "compression library error" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "compression id not within private range" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "compression failure" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "bad decompression" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "SSL_COMP_add_compression_method" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "invalid compression bit" (Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")25:T612,Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "AutodeskInstallNow.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "AutodeskInstallNow.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "AutodeskInstallNow.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "AutodeskInstallNow.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "AutodeskInstallNow.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "AutodeskInstallNow.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")26:T8df,Found reference to "RC2-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "SHA512" (Indicator: "SHA512"; File: "AutodeskInstallNow.exe") Found reference to "SHA384" (Indicator: "SHA384"; File: "AutodeskInstallNow.exe") Found reference to "RSA-SHA512" (Indicator: "SHA512"; File: "AutodeskInstallNow.exe") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "AutodeskInstallNow.exe") Found reference to "id-smime-alg-CMSRC2wrap" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "id-smime-alg-RC2wrap" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "PBE-MD2-RC2-64" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "RC2-64-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithSHA1And40BitRC2-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "PBE-SHA1-RC2-40" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithSHA1And128BitRC2-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "PBE-SHA1-RC2-128" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithSHA1And2-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithSHA1And3-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "AutodeskInstallNow.exe") Found reference to "RC2-40-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "RC2-OFB" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "RC2-CFB" (Indicator: "RC2"; File: "AutodeskInstallNow.exe") Found reference to "RC2-ECB" (Indicator: "RC2"; File: "AutodeskInstallNow.exe")27:Tb60,Found api reference "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; File: "AutodeskInstallNow.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "AutodeskInstallNow.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "AutodeskInstallNow.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "AutodeskInstallNow.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "AutodeskInstallNow.exe") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "AutodeskInstallNow.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "AutodeskInstallNow.exe") Found api reference "CryptQueryObject failed with %x" (Indicator: "CryptQueryObject"; File: "AutodeskInstallNow.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "AutodeskInstallNow.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "AutodeskInstallNow.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "AutodeskInstallNow.exe") Found api reference "CryptQueryObject failed with %x" (Indicator: "CryptQueryObject"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")28:Tda3,Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-223-004A1BDE Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-223-004A1BDE Assembly shows XOR instruction xor eax esp in Stream UID: 47720-790-00424460 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-4483-00423220 Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-4892-004B1968 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-4892-004B1968 Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-4906-004BCAAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-4906-004BCAAE Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-4907-004BD6A8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-4907-004BD6A8 Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-4944-004BD90B Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-4944-004BD90B Assembly shows XOR instruction xor eax esp in Stream UID: 47720-5028-004B5EB0 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-5042-00495CA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-5042-00495CA0 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-5077-00492400 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-5077-00492400 Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-5626-004BC8BD Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-5626-004BC8BD Assembly shows XOR instruction xor eax esp in Stream UID: 47720-5885-00467E10 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-5885-00467E10 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6058-00430BE0 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6059-00430B10 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6069-0042FCA0 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6070-0042FB80 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6093-0042FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 47720-6162-0049C65E Assembly shows XOR instruction xor ecx ebp in Stream UID: 47720-6162-0049C65E Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 47720-6219-004A38A0 Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 47720-6219-004A38A0 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 47720-6219-004A38A0 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 47720-6219-004A38A0 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6303-00402F70 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-6303-00402F70 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6307-00402E00 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-6307-00402E00 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6309-00421810 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-6309-00421810 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6591-00402EC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-6591-00402EC0 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6592-00402C70 Assembly shows XOR instruction xor ecx esp in Stream UID: 47720-6592-00402C70 Assembly shows XOR instruction xor eax esp in Stream UID: 47720-6618-00415C4029:T996,Found string "RSA PRIVATE KEY" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "DSA PRIVATE KEY" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "EC PRIVATE KEY" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "X509v3 Private Key Usage Period" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "PRIVATE KEY" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "unable to find public key parameters" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "unable to extract public key" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "public key not rsa" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "public key is not rsa" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "public key encrypt error" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "no private key assigned" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "private key does not match certificate" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "no public key" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "failed loading public key" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "failed loading private key" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "missing private key" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "invalid private key" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "unsupported public key type" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "unknown public key type" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "unable to decode rsa private key" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "private key header missing" (Indicator: "private key"; File: "AutodeskInstallNow.exe") Found string "unable to get certs public key" (Indicator: "public key"; File: "AutodeskInstallNow.exe") Found string "public key no rsa" (Indicator: "public key"; File: "AutodeskInstallNow.exe")2a:T1d6b,Found XOR loop in file "sample.bin" at offset 30022; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 46383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 50960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 52249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 52708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 56552; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 56917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 57351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 57419; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 57846; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 60554; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 60624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 85821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 86176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 86272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 197181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 198128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 198179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 652130; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 652962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 653060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742751; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1049296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1574175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1581319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1584679; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1590855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1593669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1597899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1605693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1607199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1610821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1611847; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1614975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1617031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1619873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1620513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 206628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 231706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 231727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 347899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 351431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 390382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 390695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 395716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 397410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 398109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 398190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 398815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 399301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 399377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 404552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 404781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 421981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 631816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 632435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 777350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 777466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 780154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 780266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 799912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 799950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 800022; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 800055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 800132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 800170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 800856; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 801175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 802133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 802494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 802813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 803580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 803900; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 804923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1583721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1586877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1592743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 859312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 999439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1603166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1609776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1610802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1612880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1614936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1616992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1619834; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1620474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1641732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1643086; code bytes = 80302b:T502,"AutodeskInstallNow.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008108)2c:T43e,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "AutodeskInstallNow.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "AutodeskInstallNow.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "AutodeskInstallNow.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "AutodeskInstallNow.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")2d:T51c,"AutodeskInstallNow.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008108) "AutodeskInstallNow.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008108)2e:T9392,Found reference to API (Indicator: "ReportEventW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CertAddEncodedCertificateToStore"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CertOpenStore"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CertCloseStore"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateFileA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "OpenEventA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Sleep"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FindClose"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetFilePointer"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SleepEx"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Process32NextW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ReadFile"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "TlsGetValue"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateMutexW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "LCMapStringW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ResumeThread"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "HeapCreate"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "QueueUserAPC"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetVersionExW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "EncodePointer"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetStdHandle"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetTempPathW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "TerminateThread"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateThread"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateEventW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CloseHandle"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Process32FirstW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateFileW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FlushConsoleInputBuffer"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateWaitableTimerA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetVersion"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetLastError"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "HeapFree"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "TlsAlloc"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "TlsSetValue"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "RaiseException"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "lstrlenW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "TlsFree"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "HeapSize"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "HeapAlloc"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateWaitableTimerW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCPInfo"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "DecodePointer"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetProcAddress"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetStdHandle"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetLastError"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "LocalFree"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateEventA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ExitProcess"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CompareStringW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetFileType"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "IsValidLocale"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FreeLibrary"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetHandleCount"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ExitThread"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "TerminateProcess"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "FormatMessageA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WriteFile"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ResetEvent"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetOEMCP"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "RtlUnwind"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetTickCount"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetLocalTime"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "SetEvent"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetACP"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetAcceptExSockaddrs"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "AcceptEx"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "PathRemoveFileSpecW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "PathAppendW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "PathAddBackslashW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "MessageBoxW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "InternetCanonicalizeUrlW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WSACleanup"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WSASend"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WSAStartup"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "closesocket"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ioctlsocket"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "WSASetLastError"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CoInitialize"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "getservbyname"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "gethostbyname"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "NetStatisticsGet"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "NetApiBufferFree"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CryptGenRandom"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "GetCursorInfo"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Heap32ListFirst"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Heap32ListNext"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Process32First"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Process32Next"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Thread32First"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Thread32Next"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "Module32First"; File: "AutodeskInstallNow.exe") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "getservbyname"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "gethostbyname"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListNext"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Heap32ListFirst"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "NetStatisticsGet"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FlushConsoleInputBuffer"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "AcceptEx"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetAcceptExSockaddrs"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "PathAddBackslashW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InternetCanonicalizeUrlW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CertAddEncodedCertificateToStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")2f:T409,"AutodeskInstallNow.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73d60000 "AutodeskInstallNow.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ce0000 "AutodeskInstallNow.exe" loaded module "KERNEL32.DLL" at base 77080000 "AutodeskInstallNow.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74220000 "AutodeskInstallNow.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77580000 "AutodeskInstallNow.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 772c0000 "AutodeskInstallNow.exe" loaded module "OLEAUT32.DLL" at base 77420000 "AutodeskInstallNow.exe" loaded module "RPCRT4.DLL" at base 76e00000 "AutodeskInstallNow.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 759e0000 "AutodeskInstallNow.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 759e0000 "AutodeskInstallNow.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76bb000030:T468,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 10:A0:24:51:F7:61:A2:A3:F6:AD:7E:87:D1:9D:E8:63:AB:23:1A:25; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)31:T5d9,"AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")32:Tac2,"AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "AUTODESKINSTALLNOW.EXE"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")33:T52b,"AutodeskInstallNow.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "AutodeskInstallNow.exe" trying to access non-existent file "C:\MSWSOCK.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\MSWSOCK.dll" "AutodeskInstallNow.exe" trying to access non-existent file "C:\WININET.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\WININET.dll" "AutodeskInstallNow.exe" trying to access non-existent file "C:\FLTLIB.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\MSVCP140.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\MSVCP140.dll" "AutodeskInstallNow.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "AutodeskInstallNow.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "AutodeskInstallNow.exe" trying to access non-existent file "C:\SETUPUI.DLL" "AutodeskInstallNow.exe" trying to access non-existent file "C:\SetupUi.dll"34:Tbac,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "AutodeskInstallNow.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "AutodeskInstallNow.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "AutodeskInstallNow.exe") Found reference to API "WSAstartup" (Indicator: "wsastartup"; File: "AutodeskInstallNow.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "AutodeskInstallNow.exe") Found reference to API "Not able to bind to %d" (Indicator: " bind "; File: "AutodeskInstallNow.exe") Found reference to API "could not bind to the requested symbol name" (Indicator: " bind "; File: "AutodeskInstallNow.exe") Found reference to API "unable to listen socket" (Indicator: " listen "; File: "AutodeskInstallNow.exe") Found reference to API "unable to bind socket" (Indicator: " bind "; File: "AutodeskInstallNow.exe") Found reference to API "no accept port specified" (Indicator: " accept "; File: "AutodeskInstallNow.exe") Found reference to API "nbio connect error" (Indicator: " connect "; File: "AutodeskInstallNow.exe") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; File: "AutodeskInstallNow.exe") Found reference to API "error setting nbio on accept socket" (Indicator: " accept "; File: "AutodeskInstallNow.exe") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; File: "AutodeskInstallNow.exe") Found reference to API "BIO_gethostbyname" (Indicator: "gethostbyname"; File: "AutodeskInstallNow.exe") Found reference to API "Not able to bind to %d" (Indicator: " bind "; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "WSAstartup" (Indicator: "wsastartup"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "could not bind to the requested symbol name" (Indicator: " bind "; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "unable to listen socket" (Indicator: " listen "; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "unable to bind socket" (Indicator: " bind "; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "no accept port specified" (Indicator: " accept "; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "nbio connect error" (Indicator: " connect "; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")35:Tad0,Found string "HTTP/1.0 200 OK" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 201 Created" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 202 Accepted" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 204 No Content" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 300 Multiple Choices" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 301 Moved Permanently" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 302 Moved Temporarily" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 304 Not Modified" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 400 Bad Request" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 401 Unauthorized" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 403 Forbidden" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 404 Not Found" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 500 Internal Server Error" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 501 Not Implemented" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 502 Bad Gateway" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 503 Service Unavailable" (Indicator: "HTTP/1.0"; File: "AutodeskInstallNow.exe") Found string "HTTP/1.0 200 OK" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 201 Created" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 202 Accepted" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 204 No Content" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 300 Multiple Choices" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 301 Moved Permanently" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 302 Moved Temporarily" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 304 Not Modified" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "HTTP/1.0 400 Bad Request" (Indicator: "HTTP/1.0"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")36:T885,Observed string: "Diffie-Hellman part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "lhash part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "Stack part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "CONF part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "Big Number part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "PEM part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "RSA part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "DSA part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "CONF_def part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "RAND part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "ASN.1 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "EVP part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "EC part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "ECDSA part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "SHA1 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "SHA-256 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "SHA-512 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "DlRIPE-MD160 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "SHA part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "MD5 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "MD4 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "MD2 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "6CAST part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: "Blowfish part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.") Observed string: ":RC2 part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "OpenSSL 0.")37:T81d,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "AutodeskInstallNow.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")38:T9b6,Found string "Diffie-Hellman routines" (Indicator: "diffie-hellman"; File: "AutodeskInstallNow.exe") Found string "ecdsa" (Indicator: "ecdsa"; File: "AutodeskInstallNow.exe") Found string "Diffie-Hellman part of OpenSSL 0.9.8c 05 Sep 2006" (Indicator: "diffie-hellman"; File: "AutodeskInstallNow.exe") Found string "aes256" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes256" (Indicator: "aes256"; File: "AutodeskInstallNow.exe") Found string "AES256" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES256" (Indicator: "aes256"; File: "AutodeskInstallNow.exe") Found string "AES-256-CBC" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes192" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes192" (Indicator: "aes192"; File: "AutodeskInstallNow.exe") Found string "AES192" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES192" (Indicator: "aes192"; File: "AutodeskInstallNow.exe") Found string "AES-192-CBC" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes128" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes128" (Indicator: "aes128"; File: "AutodeskInstallNow.exe") Found string "AES128" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES128" (Indicator: "aes128"; File: "AutodeskInstallNow.exe") Found string "AES-128-CBC" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "CAST5-CBC" (Indicator: "cast5"; File: "AutodeskInstallNow.exe") Found string "blowfish" (Indicator: "blowfish"; File: "AutodeskInstallNow.exe") Found string "aes-256-cfb8" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES-256-CFB8" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes-192-cfb8" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES-192-CFB8" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes-128-cfb8" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES-128-CFB8" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes-256-cfb1" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES-256-CFB1" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes-192-cfb1" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "AES-192-CFB1" (Indicator: "aes"; File: "AutodeskInstallNow.exe") Found string "aes-128-cfb1" (Indicator: "aes"; File: "AutodeskInstallNow.exe")39:Tbfc,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "AutodeskInstallNow.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "AutodeskInstallNow.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "AutodeskInstallNow.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "AutodeskInstallNow.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "AutodeskInstallNow.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "AutodeskInstallNow.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "AutodeskInstallNow.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "AutodeskInstallNow.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "AutodeskInstallNow.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "AutodeskInstallNow.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "AutodeskInstallNow.exe") Found reference to API "Module32First" (Indicator: "Module32First"; File: "AutodeskInstallNow.exe") Found reference to API "@Module32Next" (Indicator: "Module32Next"; File: "AutodeskInstallNow.exe") Found reference to API "@Module32Next" (Indicator: "Module32Next"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")3a:T408,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "AutodeskInstallNow.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "AutodeskInstallNow.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "AutodeskInstallNow.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "AutodeskInstallNow.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp")3b:T762,Found string "secretary" (Indicator: "secret"; File: "AutodeskInstallNow.exe") Found string "secretBag" (Indicator: "secret"; File: "AutodeskInstallNow.exe") Found string "set_password_callback" (Indicator: "password"; File: "AutodeskInstallNow.exe") Found string "master secret" (Indicator: "secret"; File: "AutodeskInstallNow.exe") Found string "bad password read" (Indicator: "password"; File: "AutodeskInstallNow.exe") Found string "problems getting password" (Indicator: "password"; File: "AutodeskInstallNow.exe") Found string ".?AVpassword_callback_base@detail@ssl@asio@boost@@" (Indicator: "password"; File: "AutodeskInstallNow.exe") file/memory contains long string with (Indicator: "password"; File: "AutodeskInstallNow.exe") Found string "secretary" (Indicator: "secret"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string "set_password_callback" (Indicator: "password"; Source: "00000000-00008108.00000000.260367.0146D000.00000002.mdmp") Found string ".?AVpassword_callback_base@detail@ssl@asio@boost@@" (Indicator: "password"; Source: "00000000-00008108.00000000.260367.014AE000.00000004.mdmp, 00000000-00008108.00000001.260456.014AE000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00008108.00000000.260367.014AE000.00000004.mdmp, 00000000-00008108.00000001.260456.014AE000.00000004.mdmp")3c:Ta46,"AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "AutodeskInstallNow.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3d:T400,AAABAAEAICAQ3QAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACPcACP9wAAAAAAAAAAAAAA//gA//AAAAAAAAAAAAAAB///+P+AAAAAAAAAAAAAAAiIAA//cAAAAAAAAAAAAAAI/3B/+AAAAAAAAAAAAAAAB/+Aj/cAAAAAAAAAAAAAAACP9//wAAAAAAAAAAAAAAAAf/j/gAAAAAAAAAAAAAAAAA///3AAAAAAAAAAAAAAAAAI//8AAAAAAAAAAAAAAAAAB4iHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////w////4H///8A///+AH///AA///gAH//wAA//4AAH/8AAA/+AAAH/AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB/8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAPw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample a67a55b33f92… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample a67a55b33f92…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"AutodeskInstallNow.exe\",\"applicationCategory\":[\"peexe\",\"executable\"],\"identifier\":\"a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":16},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1791074488871,"unified_at":"2026-10-04T00:41:28.871Z","metadata":{"hashes":{"sha256":"a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","sha1":"815108d6122a8102a9527bba513985d180fd195a","md5":"f415f941508ce60931ae7891eb0b9359","sha512":"e9df534d5b8200db10bb3e3fd6f29bd0fbcc626fc5a9b486b590fdcc060a2539a2b1eb65a1892655e60b413e4a9e6a078d9af1a06e983e6043558e0bbedb2922","ssdeep":"24576:mUOpI4kxBVtr13BMZ/3IdyWF6D0SzqbWZmkSep/jay9uewxwK:/V13WIdyWXSzqbWvp/jHuewxwK","ssdeep_chunks":["24576:mUOpI4k","24576:UOpI4kx","24576:OpI4kxB","24576:pI4kxBV","24576:I4kxBVt","24576:4kxBVtr","24576:kxBVtr1","24576:xBVtr13","24576:BVtr13B","24576:Vtr13BM","24576:tr13BMZ","24576:r13BMZ/","24576:13BMZ/3","24576:3BMZ/3I","24576:BMZ/3Id","24576:MZ/3Idy","24576:Z/3IdyW","24576:/3IdyWF","24576:3IdyWF6","24576:IdyWF6D","24576:dyWF6D0","24576:yWF6D0S","24576:WF6D0Sz","24576:F6D0Szq","24576:6D0Szqb","24576:D0SzqbW","24576:0SzqbWZ","24576:SzqbWZm","24576:zqbWZmk","24576:qbWZmkS","24576:bWZmkSe","24576:WZmkSep","24576:ZmkSep/","24576:mkSep/j","24576:kSep/ja","24576:Sep/jay","24576:ep/jay9","24576:p/jay9u","24576:/jay9ue","24576:jay9uew","24576:ay9uewx","24576:y9uewxw","24576:9uewxwK","49152:mUOpI4k","49152:UOpI4kx","49152:OpI4kxB","49152:pI4kxBV","49152:I4kxBVt","49152:4kxBVtr","49152:kxBVtr1","49152:xBVtr13","49152:BVtr13B","49152:Vtr13BM","49152:tr13BMZ","49152:r13BMZ/","49152:13BMZ/3","49152:3BMZ/3I","49152:BMZ/3Id","49152:MZ/3Idy","49152:Z/3IdyW","49152:/3IdyWF","49152:3IdyWF6","49152:IdyWF6D","49152:dyWF6D0","49152:yWF6D0S","49152:WF6D0Sz","49152:F6D0Szq","49152:6D0Szqb","49152:D0SzqbW","49152:0SzqbWZ","49152:SzqbWZm","49152:zqbWZmk","49152:qbWZmkS","49152:bWZmkSe","49152:WZmkSep","49152:ZmkSep/","49152:mkSep/j","49152:kSep/ja","49152:Sep/jay","49152:ep/jay9","49152:p/jay9u","49152:/jay9ue","49152:jay9uew","49152:ay9uewx","49152:y9uewxw","49152:9uewxwK","24576:/V13WId","24576:V13WIdy","24576:13WIdyW","24576:3WIdyWX","24576:WIdyWXS","24576:IdyWXSz","24576:dyWXSzq","24576:yWXSzqb","24576:WXSzqbW","24576:XSzqbWv","24576:SzqbWvp","24576:zqbWvp/","24576:qbWvp/j","24576:bWvp/jH","24576:Wvp/jHu","24576:vp/jHue","24576:p/jHuew","24576:/jHuewx","24576:jHuewxw","24576:HuewxwK"],"imphash":"985395cc0591a30b9bf290924435f514","pehash":"44c3890432f84b0c31ee0d9f7e33fe06fc87fec1"},"file_info":{"file_name":"AutodeskInstallNow.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1646480,"entropy":6,"compile_timestamp":"2013-01-18T21:23:51","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791074411000,"last_seen":1791074411000,"last_multi_scan":1791074411000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":833282,"raw_size":833536},{"name":".rdata","virtual_address":"0xcd000","virtual_size":218976,"raw_size":219136},{"name":".data","virtual_address":"0x103000","virtual_size":96100,"raw_size":77824},{"name":".tls","virtual_address":"0x11b000","virtual_size":2,"raw_size":512},{"name":".rsrc","virtual_address":"0x11c000","virtual_size":440004,"raw_size":440320},{"name":".reloc","virtual_address":"0x188000","virtual_size":67282,"raw_size":67584}],"section_names":[".text",".rdata",".data",".tls",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["expiro","parite","neshta","stealer","floxif","kryptik"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":140,"suspicious_count":16,"malicious_count":0,"total":156},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Able to check if a debugger is running"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$24","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"AutodeskInstallNow.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"AutodeskInstallNow.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"AutodeskInstallNow.exe\" queried SystemProcessInformation at 00000000-00008108-00000C15-3058235195 [PID: 8108]\n \"AutodeskInstallNow.exe\" queried SystemProcessInformation at 00000000-00008108-00000C15-3058244940 [PID: 8108]\n \"AutodeskInstallNow.exe\" queried SystemProcessInformation at 00000000-00008108-00000C15-3058451274 [PID: 8108]\n \"AutodeskInstallNow.exe\" queried SystemProcessInformation at 00000000-00008108-00000C15-3058459701 [PID: 8108]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 47720-9474-004A40F4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00008108-50452-25-01435E5E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00008108-50452-32-0143DC05\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00008108-50452-5202-014440F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$27","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertAddEncodedCertificateToStore\" (Indicator: \"CertAddEncodedCertificateToStore\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CertDeleteCertificateFromStore\" (Indicator: \"CertDeleteCertificateFromStore\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutodeskInstallNow.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"AutodeskInstallNow.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"AutodeskInstallNow.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"AutodeskInstallNow.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008108)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"AutodeskInstallNow.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00008108)\n \"AutodeskInstallNow.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00008108)\n \"AutodeskInstallNow.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008108)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AutodeskInstallNow.exe\" called \"GetMonitorInfoA\" with parameters (UID: 00000000-00008108)\n \"AutodeskInstallNow.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008108)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"AutodeskInstallNow.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008108)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: AutodeskInstallNow.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 47720-5885-00467E10\n GetTickCount@KERNEL32.dll at 47720-5886-00467D90\n GetTickCount@KERNEL32.dll at 47720-6278-00423AD0\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-1218-01456890\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-1242-01456530\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-1247-01456650\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-2264-01407E10\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-2265-01407D90\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-2832-013C3AD0\n GetTickCount@KERNEL32.DLL at 00000000-00008108-50452-3593-014444CE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 47720-4906-004BCAAE\n FindFirstFileExA@KERNEL32.DLL at 00000000-00008108-50452-1024-0145CAAE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.dll at 47720-4906-004BCAAE\n GetDriveTypeW@KERNEL32.dll at 47720-4944-004BD90B\n GetDriveTypeA@KERNEL32.DLL at 00000000-00008108-50452-1024-0145CAAE\n GetDriveTypeW@KERNEL32.DLL at 00000000-00008108-50452-1066-0145D90B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.dll at 47720-4906-004BCAAE\n FileTimeToLocalFileTime@KERNEL32.dll at 47720-4926-004BD0EF\n GetSystemTimeAsFileTime@KERNEL32.dll at 47720-4968-0049A0F8\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00008108-50452-1024-0145CAAE\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00008108-50452-1048-0145D0EF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008108-50452-1095-0143A0F8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008108-50452-1219-013B1920\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008108-50452-3593-014444CE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 47720-4968-0049A0F8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008108-50452-1095-0143A0F8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008108-50452-1219-013B1920\n GetLocalTime@KERNEL32.DLL at 00000000-00008108-50452-2631-013C3010\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008108-50452-3593-014444CE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 47720-4918-004A6D3A\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00008108-50452-1037-01446D3A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 47720-5885-00467E10\n GetVersion@KERNEL32.DLL at 00000000-00008108-50452-137-013D4D20\n GetVersionExW@KERNEL32.DLL at 00000000-00008108-50452-2264-01407E10\n GetVersionExW@KERNEL32.DLL at 00000000-00008108-50452-3836-013C41CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 47720-6168-004AA012\n EnumSystemLocalesA@KERNEL32.dll at 47720-6169-004A9FD6\n EnumSystemLocalesA@KERNEL32.dll at 47720-6171-004A9F6F\n GetLocaleInfoW@KERNEL32.dll at 47720-6176-004A9AE7\n GetLocaleInfoA@KERNEL32.dll at 47720-7074-004A9BDE\n GetLocaleInfoW@KERNEL32.dll at 47720-7076-004A9C85\n GetLocaleInfoA@KERNEL32.dll at 47720-7079-004A9EB1\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00008108-50452-2711-0144A012\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00008108-50452-2712-01449FD6\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00008108-50452-2714-01449F6F\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00008108-50452-2719-01449AE7\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00008108-50452-3651-01449BDE\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00008108-50452-3653-01449C85\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00008108-50452-3656-01449EB1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"AutodeskInstallNow.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set filename failed\" (Indicator: \"set \"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 47720-4761-004C5F30\n GetProcessHeap@KERNEL32.dll at 47720-6136-0042B150\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-636-01465F30\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-975-01455555\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-1204-01456280\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-1217-01456B30\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-2538-013CE5D0\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-2544-013CE4E0\n GetProcessHeap@KERNEL32.DLL at 00000000-00008108-50452-2679-013CB150","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.dll at 47720-6303-00402F70\n PathFileExistsW@SHLWAPI.DLL at 00000000-00008108-50452-2861-013A2F70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, edi\" and \"je 004A6F33h\" at 47720-4918-004A6D3A\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"jnc 013D4E95h\" at 00000000-00008108-50452-137-013D4D20\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 01446F33h\" at 00000000-00008108-50452-1037-01446D3A\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp+04h], 06h\" and \"je 013C4280h\" at 00000000-00008108-50452-3836-013C41CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"U:\\develop\\global\\Release\\bin\\common\\x86\\AutodeskInstallNow.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 47720-4896-0049D470\n WaitForMultipleObjects@KERNEL32.dll at 47720-6055-00431770\n WaitForSingleObject@KERNEL32.dll at 47720-6061-00412350\n WaitForSingleObject@KERNEL32.dll at 47720-6663-004124A0\n SleepEx@KERNEL32.dll at 47720-7171-004122B4\n Sleep@KERNEL32.DLL at 00000000-00008108-50452-42-0143D391\n Sleep@KERNEL32.DLL at 00000000-00008108-50452-46-0143D3D6\n Sleep@KERNEL32.DLL at 00000000-00008108-50452-62-0143D422\n Sleep@KERNEL32.DLL at 00000000-00008108-50452-1014-0143D470\n Sleep@KERNEL32.DLL at 00000000-00008108-50452-1218-01456890\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00008108-50452-2444-013D1770\n WaitForSingleObject@KERNEL32.DLL at 00000000-00008108-50452-2461-013B2350\n WaitForSingleObject@KERNEL32.DLL at 00000000-00008108-50452-2479-013B10C0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00008108-50452-3222-013B24A0\n SleepEx@KERNEL32.DLL at 00000000-00008108-50452-3747-013B22B4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutodeskInstallNow.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 47720-5785-00451700\n LoadLibraryW@KERNEL32.DLL at 00000000-00008108-50452-27-0145108D\n LoadLibraryA@KERNEL32.DLL at 00000000-00008108-50452-2155-013F1700\n LoadLibraryW@KERNEL32.DLL at 00000000-00008108-50452-2828-013C4010","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00008108.00000000.260367.00CB0000.00000004.mdmp\n \"istry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00008108.00000000.260367.00CB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process AutodeskInstallNow.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:8108:168:WilStaging_02\"\n Process AutodeskInstallNow.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8108:168:WilStaging_02\"\n Process AutodeskInstallNow.exe created mutex with name \"Local\\SM0:8108:168:WilStaging_02\"\n Process AutodeskInstallNow.exe created mutex with name \"SM0:8108:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"AutodeskInstallNow.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00008108.00000000.260367.00CB0000.00000004.mdmp\n \"istry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00008108.00000000.260367.00CB0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"AutodeskInstallNow.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75C10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"AutodeskInstallNow.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"AutodeskInstallNow.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"AutodeskInstallNow.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"AutodeskInstallNow.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"AutodeskInstallNow.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"AutodeskInstallNow.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"AutodeskInstallNow.exe\" has an writable section named \".data\"\n \"AutodeskInstallNow.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"AutodeskInstallNow.exe\" file has an entrypoint instructions - \"call\t0x4a44cc,jmp\t0x498466,int3\t,int3\t,int3\t,push\tecx,lea\tecx, [esp + 4],sub\tecx, eax,sbb\teax, eax,not\teax,and\tecx, eax,mov\teax, esp,and\teax, 0xfffff000,cmp\tecx, eax,jb\t0x498602,mov\teax, ecx,pop\tecx,xchg\tesp, eax,mov\teax, dword ptr [eax],mov\tdword ptr [esp], eax,ret\t,sub\teax, 0x1000,test\tdword ptr [eax], eax,jmp\t0x4985f4,int3\t,int3\t,int3\t,int3\t,int3\t,push\tebp,mov\tebp, esp,push\tedi,push\tesi,mov\tesi, dword ptr [ebp + 0xc],mov\tecx, dword ptr [ebp + 0x10],mov\tedi, dword ptr [ebp + 8],mov\teax, ecx,mov\tedx, ecx,add\teax, esi,cmp\tedi, esi,jbe\t0x498630,cmp\tedi, eax,jb\t0x4987d0,cmp\tecx, 0x80,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"text/javascript\" (Indicator: \"text/javascript\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$30","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"AutodeskInstallNow.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"AutodeskInstallNow.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"AutodeskInstallNow.exe\" queries basic process information of the \"C:\\AutodeskInstallNow.exe\" (UID: 8108)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"AutodeskInstallNow.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"AutodeskInstallNow.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\AutodeskInstallNow.exe\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"AutodeskInstallNow.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"AutodeskInstallNow.exe\" trying to access non-existent file \"C:\\AUTODESKINSTALLNOW.EXE.LOCAL\"\n \"AutodeskInstallNow.exe\" trying to access non-existent file \"C:\\AutodeskInstallNow.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"AutodeskInstallNow.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"7.0.53.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.openssl.org/support/faq.html\"\n Heuristic match: \"msyh.tt\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008108.00000000.260367.00CB0000.00000004.mdmp\")\n Found URL \"http://www.openssl.org/support/faq.html.....................\\crypto\\asn1\\a_object.c.\\crypto\\objects\\obj_lib.c.\\crypto\\bn\\bn_print.c%09luasn.1\" - Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$36","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"Found string \"c:\\p4vroot\\leewi_sinsgh042szbz\\pli\\licensing\\current\\toolkits\\libcurl\\openssl\\crypto\\ec\\ec2_smpt.c\" (Indicator: \"libcurl\"; File: \"AutodeskInstallNow.exe\")\n Found string \"c:\\p4vroot\\leewi_sinsgh042szbz\\pli\\licensing\\current\\toolkits\\libcurl\\openssl\\crypto\\ec\\ec2_smpt.c\" (Indicator: \"libcurl\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00008108\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"AutodeskInstallNow.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetModuleFileName failed!\" (Indicator: \"GetModuleFileName\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetModuleFileName failed!\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"IsUserAnAdmin@SHELL32.DLL at 00000000-00008108-50452-3836-013C41CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"no hostname specified\" (Indicator: \"hostname\"; File: \"AutodeskInstallNow.exe\")\n Found string \"bad hostname lookup\" (Indicator: \"hostname\"; File: \"AutodeskInstallNow.exe\")\n Found string \"no hostname specified\" (Indicator: \"hostname\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found string \"bad hostname lookup\" (Indicator: \"hostname\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"AutodeskInstallNow.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\AutodeskInstallNow.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00008108.00000000.260367.00CB0000.00000004.mdmp, 00000000-00008108.00000001.260456.00CB0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008108.00000000.260367.00CB0000.00000004.mdmp\")\n Found string \"INDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008108.00000001.260456.00CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: AutodeskInstallNow.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00008108.00000000.260367.0146D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"AutodeskInstallNow.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00008108.00000000.260367.0146D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"fread\" (Source: AutodeskInstallNow.exe, API is part of module: UCRTBASE.DLL)\n Found string \"accept\" (Source: AutodeskInstallNow.exe, API is part of module: WS2_32.DLL)\n Found string \"socket\" (Source: AutodeskInstallNow.exe, API is part of module: WS2_32.DLL)\n Found string \"getservbyname\" (Source: AutodeskInstallNow.exe, API is part of module: WS2_32.DLL)\n Found string \"connect\" (Source: AutodeskInstallNow.exe, API is part of module: WS2_32.DLL)\n Found string \"fopen\" (Source: AutodeskInstallNow.exe, API is part of module: UCRTBASE.DLL)\n Found string \"gethostbyname\" (Source: AutodeskInstallNow.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"AutodeskInstallNow.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"AutodeskInstallNow.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00008108-50452-25-01435E5E\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00008108-50452-32-0143DC05","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"AutodeskInstallNow.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00008108-50452-10-0143FFC4\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008108-50452-20-0143F988\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008108-50452-3580-014402A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 47720-97-004985D3\n GetStartupInfoW@KERNEL32.DLL at 00000000-00008108-50452-3583-014416E3\n GetStartupInfoW@KERNEL32.DLL at 00000000-00008108-50452-4515-01438466","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\AutodeskInstallNow.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"ShellExecuteExW@SHELL32.dll at 47720-6303-00402F70\n ShellExecuteExW@SHELL32.DLL at 00000000-00008108-50452-2861-013A2F70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"ResumeThread@KERNEL32.DLL at 00000000-00008108-50452-1255-014561D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00000000-00008108-50452-2623-013CC780","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"closesocket@WS2_32.DLL at 00000000-00008108-50452-337-013B4C50\n setsockopt@WS2_32.DLL at 00000000-00008108-50452-338-013B4BE0\n closesocket@WS2_32.DLL at 00000000-00008108-50452-1201-01456FE0\n WSASocketW@WS2_32.DLL at 00000000-00008108-50452-2468-013D0630\n listen@WS2_32.DLL at 00000000-00008108-50452-2623-013CC780\n setsockopt@WS2_32.DLL at 00000000-00008108-50452-2630-013CB560\n setsockopt@WS2_32.DLL at 00000000-00008108-50452-2640-013CB170\n setsockopt@WS2_32.DLL at 00000000-00008108-50452-3497-013CFA70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 47720-6592-00402C70\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00000000-00008108-50452-3150-013A2C70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.dll at 47720-97-004985D3\n GetCommandLineW@KERNEL32.DLL at 00000000-00008108-50452-4515-01438466","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 47720-6307-00402E00\n GetModuleFileNameA@KERNEL32.dll at 47720-6591-00402EC0\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00008108-50452-23-0143F5B2\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00008108-50452-2629-013A2BC0\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00008108-50452-2673-013A2B20\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00008108-50452-2828-013C4010\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00008108-50452-2830-013C3B80\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00008108-50452-2865-013A2E00\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00008108-50452-3149-013A2EC0\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00008108-50452-3588-0144437C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"ExitProcess@KERNEL32.DLL at 00000000-00008108-50452-19-0143F9B3\n TerminateProcess@KERNEL32.DLL at 00000000-00008108-50452-25-01435E5E\n TerminateProcess@KERNEL32.DLL at 00000000-00008108-50452-31-0143DD2E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"AutodeskInstallNow.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"AutodeskInstallNow.exe\" has a TLS callback with entrypoint at 0x4b6c90","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CertDeleteCertificateFromStore\n CreateFileA\n LoadLibraryA\n Sleep\n SleepEx\n Process32NextW\n GetModuleHandleW\n GetVersionExW\n GetDriveTypeW\n IsDebuggerPresent\n GetTempPathW\n FindFirstFileExA\n CreateThread\n GetCommandLineW\n GetTempFileNameW\n GetModuleFileNameA\n LoadLibraryW\n Process32FirstW\n CreateFileW\n UnhandledExceptionFilter\n GetDriveTypeA\n GetProcAddress\n GetStartupInfoW\n GetModuleFileNameW\n CreateToolhelp32Snapshot\n ExitThread\n TerminateProcess\n WriteFile\n GetTickCount\n ShellExecuteExW\n bind\n recv\n listen\n WSASend\n WSAStartup\n send\n closesocket\n WSASocketW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]}],"intel_graph":{"map":{"File:a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7":{"type":"File","value":"a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b0a2684acd9a19d84b5935aa5a6566c0515bb34ab8cb5b818885e9e575a0de53":{"type":"File","value":"b0a2684acd9a19d84b5935aa5a6566c0515bb34ab8cb5b818885e9e575a0de53","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/vnd.ms-cab-compressed"}},"chains":[{"id":"1556103624105901946","root":"File:a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1556103658890815971","root":"File:a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","to_key":"File:b0a2684acd9a19d84b5935aa5a6566c0515bb34ab8cb5b818885e9e575a0de53"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","edges":[{"edge_kind":"extracted","from_key":"File:a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","to_key":"File:b0a2684acd9a19d84b5935aa5a6566c0515bb34ab8cb5b818885e9e575a0de53"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":52,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["expiro","parite","neshta","stealer","floxif","kryptik"],"sandbox_reports":[{"id":"6ac1a06ac28349711a00e32c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"AutodeskInstallNow.exe","analysis_start_time":"2026-10-04T00:40:11+00:00","indicators_count":{"informative":140,"suspicious":20,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}],"processes":[{"pid":8108,"ppid":0,"name":"AutodeskInstallNow.exe","command_line":"","sha256":"a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7","normalized_path":"C:\\AutodeskInstallNow.exe","uid":"00000000-00008108","icon":"$3d"}],"all_imported_dlls":["gdi32full.dll","ole32.dll","vcruntime140.dll","oleaut32.dll","TextInputFramework.dll","WinTypes.dll","wow64cpu.dll","shell32.dll","cryptbase.dll","shlwapi.dll","msvcp_win.dll","msasn1.dll","kernel32.dll","bcryptprimitives.dll","sechost.dll","profapi.dll","mswsock.dll","clbcatq.dll","wow64.dll","KernelBase.dll","apphelp.dll","rpcrt4.dll","VxSSL32.dll","CoreMessaging.dll","SHCore.dll","gdi32.dll","kernel.appcore.dll","powrprof.dll","imm32.dll","ntdll.dll","wow64win.dll","advapi32.dll","ws2_32.dll","wininet.dll","msctf.dll","ntmarta.dll","cfgmgr32.dll","ucrtbase.dll","sspicli.dll","GdiPlus.dll","crypt32.dll","cryptsp.dll","uxtheme.dll","dwmapi.dll","user32.dll","combase.dll","win32u.dll","fltLib.dll","msvcp140.dll","CoreUIComponents.dll","msvcrt.dll","windows.storage.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"b0a2684acd9a19d84b5935aa5a6566c0515bb34ab8cb5b818885e9e575a0de53","sha256":"b0a2684acd9a19d84b5935aa5a6566c0515bb34ab8cb5b818885e9e575a0de53","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"name":"Local\\SM0:8108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]},{"name":"SM0:8108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac1a06ac28349711a00e32c"}]}]}},"report_ids":{"sandbox_job_ids":["6ac1a06ac28349711a00e32c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample a67a55b33f92… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample a67a55b33f92…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7"}],["$","meta","4",{"property":"og:title","content":"Sample a67a55b33f92… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample a67a55b33f92…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a67a55b33f92f4b26e346087e1356da1ae10f7a6e24b469a6954e0b567ba26e7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample a67a55b33f92… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample a67a55b33f92…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3e","11",{}]]