Windows Analysis Report
OpenWebStart_windows-x64_1_9_1.exe

Overview

General Information

Sample name: OpenWebStart_windows-x64_1_9_1.exe
Analysis ID: 1428872
MD5: 634b835b27f16ab3730596c33fc7e000
SHA1: f12c2733f4630ed883995c421c824d93211dd194
SHA256: af74ea2be152faef0e82c0b4aa32aa479cb106793269b096868c51926051375c
Infos:

Detection

Score: 22
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Exploit detected, runtime environment starts unknown processes
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13219448 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 1_2_00007FFE13219448
Source: OpenWebStart_windows-x64_1_9_1.exe Static PE information: certificate valid
Source: OpenWebStart_windows-x64_1_9_1.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: java.exe, 00000001.00000002.1781691193.00007FFDFF2C2000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\java_objs\java.pdb source: java.exe, 00000001.00000000.1764838034.00007FF743C3E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\hotspot\windows_amd64_compiler2\product\jvm.pdb source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libjava\java.pdb source: java.exe, 00000001.00000002.1782030611.00007FFE1322A000.00000002.00000001.01000000.0000000A.sdmp
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C35310 FindFirstFileExW, 1_2_00007FF743C35310
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C179F0 FindFirstFileA,FindNextFileA,strchr,FindClose, 1_2_00007FF743C179F0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF280E70 FindFirstFileExW,FindClose,wcscpy_s, 1_2_00007FFDFF280E70
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13219EF0 wcslen,malloc,free,_errno,wcscpy,free,GetFileAttributesW,wcslen,wcscat,FindFirstFileW,free,GetLastError,wcscmp,wcscmp,wcslen,FindNextFileW,GetLastError,FindClose,FindClose,free, 1_2_00007FFE13219EF0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321B198 IsDBCSLeadByte,_fullpath,strlen,IsDBCSLeadByte,strchr,isalpha,toupper,strlen,FindFirstFileA,FindClose,strlen,strlen,_errno,_errno, 1_2_00007FFE1321B198
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321B5F8 malloc,_wfullpath,wcslen,wcsncmp,wcschr,towupper,_errno,_errno,free,wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,_errno, 1_2_00007FFE1321B5F8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321B91C wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,wcslen,_errno, 1_2_00007FFE1321B91C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13219C34 GetFileAttributesExW,GetLastError,FindFirstFileW,wcsrchr,wcscmp,FindClose,free, 1_2_00007FFE13219C34
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321A5A8 GetFileAttributesExW,GetLastError,FindFirstFileW,FindClose, 1_2_00007FFE1321A5A8
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\temp\E4J5D2~1.TMP\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\temp\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\temp\E4J5D2~1.TMP\jre\ Jump to behavior

Software Vulnerabilities
barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Process created: C:\Windows\System32\conhost.exe
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865775399.000000001B670000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940186270.000000001B687000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867322116.000000001B677000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodesp
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansionG
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace:
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/include-comments
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/include-comments1
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicates
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicatesO
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/namespace-growth
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/namespace-growth;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refsi
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs:
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant-t
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validate-annotations9
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939856872.000000001B4D9000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939856872.000000001B4D9000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/dynamicffer
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default=
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schemapl
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdefU
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydefi
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris6
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language:
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xincludeC
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node7
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name3
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/input-buffer-sizedtd/XM
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor7
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner7
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager:
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-handler=
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter8
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binderFf
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binderFfA
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver/xml/featu5
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table6
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory8
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtdD
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/locale
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/localeF
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/security-manager
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/security-managerI
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypes
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypesDocume
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/dom/properties/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867218820.000000001B698000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940214535.000000001B6A7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865775399.000000001B670000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/dom/properties/t
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSourceP
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSourceP;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/)
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/ache/xerces/in
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtding
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state.org/do
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865775399.000000001B670000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940186270.000000001B687000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867322116.000000001B677000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/feature/secure-processing
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchema
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchemaD
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870819960.0000000019909000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865939929.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938159827.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalStylesheet
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870819960.0000000019909000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865939929.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938159827.00000000198D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalStylesheet;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5B7D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.dom.DOMResult/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5B7D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.dom.DOMSource/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5B7D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.sax.SAXResult/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.sax.SAXSource/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature/xmlfilter
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/featureF
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.stax.StAXResult/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.stax.StAXSource/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.stream.StreamResult/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.stream.StreamSource/feature
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.transform.stream.StreamSource/feature6
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: http://openjdk.java.net/jeps/220).
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://timestamp.sectigo.com
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1868274351.000000001BC27000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865519977.000000001BC17000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D6883000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866991713.000000001BC1E000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841862656.000000001BBFD000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2942197531.000000001BC2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ej-technologies.com/shared-mime-info-ext
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1868274351.000000001BC27000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865519977.000000001BC17000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D6883000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866991713.000000001BC1E000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841862656.000000001BBFD000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2942197531.000000001BC2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.freedesktop.org/standards/shared-mime-info
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870819960.0000000019909000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865939929.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938159827.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/is-standalone
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938159827.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/XmlFeatureManager
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementAttributeLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870819960.0000000019909000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865939929.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938159827.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/enableExtensionFunctions
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit//apache.o
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityReplacementLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/events/EventEx
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/getEntityCountInfo
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxElementDepth
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimitl
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxOccurLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1863269321.000000001B609000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1843961689.000000001B5F7000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940110120.000000001B620000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870238044.000000001B610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5B7D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.apache.org/xalan
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.apache.org/xslt
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD7
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1841779815.000000001B649000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940159459.000000001B65F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/erces/intern
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-general-entities7
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespace-prefixes(
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces?
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940674966.000000001B8C2000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/string-interning
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940674966.000000001B8C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/string-interning0(&
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/use-entity-resolver20
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/validation
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940674966.000000001B8C2000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940674966.000000001B8C2000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5C33000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/dom-node
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2940674966.000000001B8C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/dom-nodet
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1870819960.0000000019909000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1865939929.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938159827.00000000198D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5A9A000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D5923000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1866303166.000000001B4D4000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2939969428.000000001B523000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1867059929.000000001B4DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/xml-string?
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D61A3000.00000004.00001000.00020000.00000000.sdmp, java.exe, java.exe, 00000001.00000002.1782030611.00007FFE1322A000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://adoptium.net/
Source: java.exe, 00000001.00000002.1782030611.00007FFE1322A000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://adoptium.net/java.vendor.url.bughttps://github.com/adoptium/adoptium-support/issues%d.%djava
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://download-openwebstart.com/updates/updates.xml
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2934305993.0000000003748000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://github.com/ad
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D61A3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/adoptium/adoptium-
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D61A3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/adoptium/adoptium-...
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D61A3000.00000004.00001000.00020000.00000000.sdmp, java.exe, java.exe, 00000001.00000002.1782030611.00007FFE1322A000.00000002.00000001.01000000.0000000A.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: https://github.com/adoptium/adoptium-support/issues
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: https://github.com/adoptium/adoptium-support/issuesgeneric-da-ea-disableassertions-enableassertions-
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1764241192.0000000002612000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1764084084.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/adoptium/jdk8u.git
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1764241192.0000000002612000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1764084084.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/adoptium/temurin-build.git
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2972338290.00000000D595B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://openwebstart.com/
Detected potential crypto function
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Code function: 0_2_04EE5641 0_2_04EE5641
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Code function: 0_2_04EE47E1 0_2_04EE47E1
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2D164 1_2_00007FF743C2D164
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C3A6EC 1_2_00007FF743C3A6EC
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C33950 1_2_00007FF743C33950
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1F498 1_2_00007FF743C1F498
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1EC88 1_2_00007FF743C1EC88
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2541C 1_2_00007FF743C2541C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C203D0 1_2_00007FF743C203D0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C30368 1_2_00007FF743C30368
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C27350 1_2_00007FF743C27350
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C35310 1_2_00007FF743C35310
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C19AA8 1_2_00007FF743C19AA8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2CAA4 1_2_00007FF743C2CAA4
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C20A60 1_2_00007FF743C20A60
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1F294 1_2_00007FF743C1F294
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1EA84 1_2_00007FF743C1EA84
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C309E8 1_2_00007FF743C309E8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C27998 1_2_00007FF743C27998
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C3A968 1_2_00007FF743C3A968
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C33950 1_2_00007FF743C33950
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C37954 1_2_00007FF743C37954
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C3C868 1_2_00007FF743C3C868
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1F090 1_2_00007FF743C1F090
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C20038 1_2_00007FF743C20038
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C28810 1_2_00007FF743C28810
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1878F 1_2_00007FF743C1878F
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C17F95 1_2_00007FF743C17F95
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2BF24 1_2_00007FF743C2BF24
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C24F10 1_2_00007FF743C24F10
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C20E98 1_2_00007FF743C20E98
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2FED4 1_2_00007FF743C2FED4
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1EE8C 1_2_00007FF743C1EE8C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C17E28 1_2_00007FF743C17E28
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2AA39E 1_2_00007FFDFF2AA39E
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF275FC8 1_2_00007FFDFF275FC8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2A169C 1_2_00007FFDFF2A169C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF285E80 1_2_00007FFDFF285E80
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF291F10 1_2_00007FFDFF291F10
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2916F0 1_2_00007FFDFF2916F0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF296720 1_2_00007FFDFF296720
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2A6580 1_2_00007FFDFF2A6580
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF290570 1_2_00007FFDFF290570
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2AA39E 1_2_00007FFDFF2AA39E
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF284E10 1_2_00007FFDFF284E10
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF294608 1_2_00007FFDFF294608
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF29363C 1_2_00007FFDFF29363C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF290E30 1_2_00007FFDFF290E30
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF276C74 1_2_00007FFDFF276C74
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2A44A0 1_2_00007FFDFF2A44A0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2AA39E 1_2_00007FFDFF2AA39E
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF283410 1_2_00007FFDFF283410
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2973E0 1_2_00007FFDFF2973E0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2A32B8 1_2_00007FFDFF2A32B8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF277AA8 1_2_00007FFDFF277AA8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2A2AE0 1_2_00007FFDFF2A2AE0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF29816C 1_2_00007FFDFF29816C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2781D8 1_2_00007FFDFF2781D8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2840E0 1_2_00007FFDFF2840E0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF298950 1_2_00007FFDFF298950
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126E32C8 1_2_00007FFE126E32C8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126E53F8 1_2_00007FFE126E53F8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126E1190 1_2_00007FFE126E1190
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126E8ED8 1_2_00007FFE126E8ED8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126E5565 1_2_00007FFE126E5565
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126E5D5F 1_2_00007FFE126E5D5F
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13226B90 1_2_00007FFE13226B90
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13214FE8 1_2_00007FFE13214FE8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13227AB0 1_2_00007FFE13227AB0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13214C54 1_2_00007FFE13214C54
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13218480 1_2_00007FFE13218480
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE132453BC 1_2_00007FFE132453BC
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE132427EC 1_2_00007FFE132427EC
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13242F04 1_2_00007FFE13242F04
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13305878 1_2_00007FFE13305878
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_0000021D3E4963A1 1_2_0000021D3E4963A1
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_0000021D3E497240 1_2_0000021D3E497240
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: String function: 00007FF743C16548 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: String function: 00007FF743C1114C appears 33 times
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: String function: 00007FFE132410F0 appears 84 times
PE file does not import any functions
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: OpenWebStart_windows-x64_1_9_1.exe Binary or memory string: OriginalFilename vs OpenWebStart_windows-x64_1_9_1.exe
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2969200176.00000000666A4000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilenamejvm.dll8 vs OpenWebStart_windows-x64_1_9_1.exe
Source: classification engine Classification label: sus22.expl.winEXE@4/204@0/0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C16640 GetLastError,FormatMessageA,MessageBoxA,fwprintf,LocalFree, 1_2_00007FF743C16640
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2812C0 GetDiskFreeSpaceExW, 1_2_00007FFDFF2812C0
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4jtw727617619 Jump to behavior
Source: OpenWebStart_windows-x64_1_9_1.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe System information queried: HandleInformation Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: java.exe String found in binary or memory: -help
Source: java.exe String found in binary or memory: sun/launcher/LauncherHelper
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File read: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe "C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe"
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe c:\users\user\appdata\local\temp\E4J5D2~1.TMP\jre\bin\java.exe -version
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe c:\users\user\appdata\local\temp\E4J5D2~1.TMP\jre\bin\java.exe -version Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: opengl32.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: glu32.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4657278A-411B-11d2-839A-00C04FD918D0}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: OpenWebStart_windows-x64_1_9_1.exe Static PE information: certificate valid
Source: OpenWebStart_windows-x64_1_9_1.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: OpenWebStart_windows-x64_1_9_1.exe Static file information: File size 55956048 > 1048576
Source: OpenWebStart_windows-x64_1_9_1.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: java.exe, 00000001.00000002.1781691193.00007FFDFF2C2000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\java_objs\java.pdb source: java.exe, 00000001.00000000.1764838034.00007FF743C3E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\hotspot\windows_amd64_compiler2\product\jvm.pdb source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libjava\java.pdb source: java.exe, 00000001.00000002.1782030611.00007FFE1322A000.00000002.00000001.01000000.0000000A.sdmp
Binary contains a suspicious time stamp
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: 0x9A158DFF [Sat Dec 2 04:24:31 2051 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1691C LoadLibraryA,GetProcAddress,GetProcAddress, 1_2_00007FF743C1691C
PE file contains sections with non-standard names
Source: sawindbg.dll.0.dr Static PE information: section name: .00cfg
Source: unpack200.exe.0.dr Static PE information: section name: .00cfg
Source: WindowsAccessBridge-64.dll.0.dr Static PE information: section name: .gxfg
Source: WindowsAccessBridge-64.dll.0.dr Static PE information: section name: .gehcont
Source: freetype.dll.0.dr Static PE information: section name: .00cfg
Source: instrument.dll.0.dr Static PE information: section name: .gxfg
Source: instrument.dll.0.dr Static PE information: section name: .gehcont
Source: java.exe.0.dr Static PE information: section name: .gxfg
Source: java.exe.0.dr Static PE information: section name: .gehcont
Source: javaw.exe.0.dr Static PE information: section name: .gxfg
Source: javaw.exe.0.dr Static PE information: section name: .gehcont
Source: jli.dll.0.dr Static PE information: section name: .gxfg
Source: jli.dll.0.dr Static PE information: section name: .gehcont
Source: msvcp140.dll.0.dr Static PE information: section name: .didat
Drops PE files
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\j2pkcs11.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\attach.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\pack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\nio.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\ktab.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\instrument.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sspi_bridge.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\server\jvm.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\kinit.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\hprof.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\w2k_lsa_auth.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jaas_nt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\freetype.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\WindowsAccessBridge-64.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jsound.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\j2gss.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\servertool.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java_crw_demo.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\dt_socket.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jdwp.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\klist.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\JavaAccessBridge-64.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\net.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jli.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\npt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sawindbg.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jabswitch.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jsdt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jawt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\JAWTAccessBridge-64.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\rmiregistry.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\policytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jjs.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\unpack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\keytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\unpack.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\verify.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\lcms.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\fontmanager.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java-rmi.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\rmid.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sunec.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\tnameserv.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\splashscreen.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\dt_shmem.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\awt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\zip.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jsoundds.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\j2pcsc.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\management.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\mlib_image.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sunmscapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\orbd.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2A6580 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_00007FFDFF2A6580
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\j2pkcs11.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\attach.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\pack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\nio.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\ktab.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\instrument.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sspi_bridge.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\server\jvm.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\kinit.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\hprof.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\w2k_lsa_auth.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jaas_nt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\freetype.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\WindowsAccessBridge-64.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jsound.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\j2gss.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\servertool.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java_crw_demo.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\dt_socket.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jdwp.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\klist.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\JavaAccessBridge-64.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\net.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jli.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\npt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sawindbg.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jabswitch.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jsdt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jawt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\JAWTAccessBridge-64.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\rmiregistry.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\policytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jjs.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\unpack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\keytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\unpack.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\lcms.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\verify.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\fontmanager.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java-rmi.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\rmid.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sunec.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\tnameserv.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\splashscreen.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\dt_shmem.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\awt.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\zip.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\jsoundds.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\j2pcsc.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\management.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\mlib_image.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\orbd.exe Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\sunmscapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe API coverage: 7.3 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File Volume queried: C:\Program Files FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C35310 FindFirstFileExW, 1_2_00007FF743C35310
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C179F0 FindFirstFileA,FindNextFileA,strchr,FindClose, 1_2_00007FF743C179F0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF280E70 FindFirstFileExW,FindClose,wcscpy_s, 1_2_00007FFDFF280E70
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13219EF0 wcslen,malloc,free,_errno,wcscpy,free,GetFileAttributesW,wcslen,wcscat,FindFirstFileW,free,GetLastError,wcscmp,wcscmp,wcslen,FindNextFileW,GetLastError,FindClose,FindClose,free, 1_2_00007FFE13219EF0
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321B198 IsDBCSLeadByte,_fullpath,strlen,IsDBCSLeadByte,strchr,isalpha,toupper,strlen,FindFirstFileA,FindClose,strlen,strlen,_errno,_errno, 1_2_00007FFE1321B198
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321B5F8 malloc,_wfullpath,wcslen,wcsncmp,wcschr,towupper,_errno,_errno,free,wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,_errno, 1_2_00007FFE1321B5F8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321B91C wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,wcslen,_errno, 1_2_00007FFE1321B91C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13219C34 GetFileAttributesExW,GetLastError,FindFirstFileW,wcsrchr,wcscmp,FindClose,free, 1_2_00007FFE13219C34
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321A5A8 GetFileAttributesExW,GetLastError,FindFirstFileW,FindClose, 1_2_00007FFE1321A5A8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321D548 GetSystemInfo,IsProcessorFeaturePresent,IsProcessorFeaturePresent, 1_2_00007FFE1321D548
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\temp\E4J5D2~1.TMP\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\temp\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\ Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe File opened: c:\users\user\appdata\local\temp\E4J5D2~1.TMP\jre\ Jump to behavior
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938022505.0000000019690000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: wjava/lang/VirtualMachineError
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1784951381.0000000019795000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: java/lang/VirtualMachineError
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: Unable to link/verify VirtualMachineError class
Source: java.exe, 00000001.00000002.1776890466.0000021D3CBD7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938022505.0000000019690000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1784951381.0000000019795000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2938022505.0000000019690000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: |zVirtualMachineError.java
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1784951381.0000000019795000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: )$T+com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: _well_known_klasses[SystemDictionary::VirtualMachineError_klass_knum]
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000003.1784951381.0000000019795000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2950431619.000000006646B000.00000002.00000001.01000000.00000008.sdmp, java.exe, 00000001.00000002.1769984341.000000006646B000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: &fSize of %s (%llu bytes) must be aligned to %llu bytes-2147483648vtable list too smallguarantee((*n) < count) failedC:\workspace\openjdk-build\workspace\build\src\hotspot\src\share\vm\memory\universe.cppGenesisheap address: 0x%016llx, size: %llu MB, Compressed Oops mode: %s:0x%016llx, Oop shift amount: %dCould not reserve enough space for %lluKB object heap32-bitZero basedNon-zero basedUnable to link/verify VirtualMachineError classJava heap space: failed reallocation of scalar replaced objectsUnable to link/verify Finalizer.register methodUnable to link/verify Unsafe.throwIllegalAccessError methodUnable to link/verify ClassLoader.addClass methodProtectionDomain.impliesCreateAccessControlContext() has the wrong linkageHeap{Heap before GC invocations=%u (full %u):Heap after GC invocations=%u (full %u): ,heapsymbol_tablestring_tablecodecachedictionaryclassloader_data_graphjni_handlesc-heapcodecache_oopsVerifySubSet: '%s' memory sub-system is unknown, please correct it[Verifying Threads Heap SymbolTable StringTable CodeCache SystemDictionary MetaspaceAux JNIHandles C-heap CodeCache Oops C:\workspace\openjdk-build\workspace\build\src\hotspot\src\share\vm\gc_interface/collectedHeap.inline.hppC:\workspace\openjdk-build\workspace\build\src\hotspot\src\share\vm\oops\arrayKlass.cpp[] - length: %dshould have a classguarantee(component_mirror()->klass() != NULL) failedmust be arrayguarantee(obj->is_array()) failedarray with negative length?guarantee(a->length() >= 0) failedshould be klassvtable restored by this callguarantee(is_constantPool()) failedA constant pool lockRESOLVE %s %s %s:%d
Source: OpenWebStart_windows-x64_1_9_1.exe, 00000000.00000002.2933586501.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2ECB4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FF743C2ECB4
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1691C LoadLibraryA,GetProcAddress,GetProcAddress, 1_2_00007FF743C1691C
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C36FAC GetProcessHeap, 1_2_00007FF743C36FAC
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C2ECB4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FF743C2ECB4
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1B204 SetUnhandledExceptionFilter, 1_2_00007FF743C1B204
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1A944 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FF743C1A944
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C1B05C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FF743C1B05C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFDFF2BD460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFDFF2BD460
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126EB354 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFE126EB354
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE126EBDFC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFE126EBDFC
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13228A84 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFE13228A84
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE13229614 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFE13229614
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE132473B8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFE132473B8
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1324684C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFE1324684C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1330C6CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFE1330C6CC
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Memory protected: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Process created: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe c:\users\user\appdata\local\temp\E4J5D2~1.TMP\jre\bin\java.exe -version Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C3C6B0 cpuid 1_2_00007FF743C3C6B0
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW, 1_2_00007FFDFF279B90
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx, 1_2_00007FFDFF29F930
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: malloc,GetLocaleInfoA,strlen,malloc,GetLocaleInfoA,GetLocaleInfoA,malloc,GetLocaleInfoA,GetLocaleInfoA,strcpy,strcpy,malloc,strcmp,strcpy,strcmp,strcpy,strcpy,strcpy, 1_2_00007FFE1321D33C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: malloc,GetLocaleInfoA,atoi,strcpy,strcmp,MultiByteToWideChar,strcmp,IsValidCodePage,GetWindowsDirectoryA,strlen,strlen,strcat,fopen,fclose,strcpy, 1_2_00007FFE1321D644
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\7276 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\jce.jar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\jfr.jar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\server\jvm.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\7352 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\rt.jar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\jsse.jar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\jce.jar VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\lib\charsets.jar VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Code function: 0_2_6646A64C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_6646A64C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321CC3C GetTempPathW,_wcsdup,_wgetenv,_wcsdup,GetVersionExA,_strdup,memset,GetNativeSystemInfo,strlen,GetSystemDirectoryW,wcsncat,GetFileVersionInfoSizeW,malloc,GetFileVersionInfoW,VerQueryValueW,free,_strdup,_wgetenv,wcslen,_wcsdup,GetUserNameW,GetLastError,malloc,GetUserNameW,free,GetUserDefaultLangID,GetSystemDefaultLCID,GetUserDefaultUILanguage,GetStdHandle,GetFileType,GetStdHandle,GetFileType,GetCurrentDirectoryW,_wcsdup, 1_2_00007FFE1321CC3C
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FF743C3A6EC _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 1_2_00007FF743C3A6EC
Source: C:\Users\user\AppData\Local\Temp\e4j5D2A.tmp_dir1713545260\jre\bin\java.exe Code function: 1_2_00007FFE1321CC3C GetTempPathW,_wcsdup,_wgetenv,_wcsdup,GetVersionExA,_strdup,memset,GetNativeSystemInfo,strlen,GetSystemDirectoryW,wcsncat,GetFileVersionInfoSizeW,malloc,GetFileVersionInfoW,VerQueryValueW,free,_strdup,_wgetenv,wcslen,_wcsdup,GetUserNameW,GetLastError,malloc,GetUserNameW,free,GetUserDefaultLangID,GetSystemDefaultLCID,GetUserDefaultUILanguage,GetStdHandle,GetFileType,GetStdHandle,GetFileType,GetCurrentDirectoryW,_wcsdup, 1_2_00007FFE1321CC3C
Source: C:\Users\user\Desktop\OpenWebStart_windows-x64_1_9_1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428872 Sample: OpenWebStart_windows-x64_1_... Startdate: 19/04/2024 Architecture: WINDOWS Score: 22 6 OpenWebStart_windows-x64_1_9_1.exe 5 262 2->6         started        file3 14 C:\Users\user\AppData\Local\Temp\...\java.exe, PE32+ 6->14 dropped 16 C:\Users\user\AppData\Local\Temp\...\zip.dll, PE32+ 6->16 dropped 18 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32+ 6->18 dropped 20 97 other files (none is malicious) 6->20 dropped 9 java.exe 3 6->9         started        process4 signatures5 22 Exploit detected, runtime environment starts unknown processes 9->22 12 conhost.exe 9->12         started        process6
⊘No contacted IP infos