Windows Analysis Report
https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar

Overview

General Information

Sample URL: https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar
Analysis ID: 1431469
Infos:

Detection

Score: 24
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Exploit detected, runtime environment starts unknown processes
Contains functionality to detect virtual machines (SLDT)
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Found inlined nop instructions (likely shell or obfuscated code)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)

Classification

Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49748 version: TLS 1.2

Software Vulnerabilities

barindex
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 4x nop then cmp eax, dword ptr [ecx+04h] 11_2_0287FBA6
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: global traffic HTTP traffic detected: GET /maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar HTTP/1.1Host: repo.maven.apache.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=65HSr++Fuo+LbRH&MD=bw4YOY8N HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=65HSr++Fuo+LbRH&MD=bw4YOY8N HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic DNS traffic detected: DNS query: repo.maven.apache.org
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: java.exe, 0000000B.00000002.2530976526.0000000009F6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 0000000B.00000002.2530976526.0000000009F71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: http://picocli.info/)
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: http://stackoverflow.com/a/12495480/1440785
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: http://tiswww.case.edu/php/chet/bash/FAQ
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: http://zsh.sourceforge.net/Doc/Release/Options.html#index-COMPLETE_005fALIASES
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: https://github.com/scop/bash-completion)
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: https://stackoverflow.com/questions/17042057/bash-check-element-in-array-for-elements-in-another-arr
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: https://stackoverflow.com/questions/3249432/can-a-bash-tab-completion-script-be-used-in-zsh/27853970
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: https://www.gnu.org/software/bash/manual/html_node/Programmable-Completion.html#Programmable-Complet
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr String found in binary or memory: https://www.gnu.org/software/bash/manual/html_node/The-Shopt-Builtin.html
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: classification engine Classification label: sus24.expl.win@24/211@4/5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\8e79ea8f-e22d-448d-88fd-ec974ae80df0.tmp Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\System32\7za.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2208,i,13480584101053597956,9907863780671905047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar"
Source: unknown Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Downloads\picocli-4.1.4.jar"
Source: C:\Windows\System32\7za.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Downloads\picocli-4.1.4.jar" picocli.AutoComplete
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2208,i,13480584101053597956,9907863780671905047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Source: C:\Windows\System32\7za.exe Section loaded: 7z.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe File opened: C:\Program Files (x86)\Java\jre-1.8\lib\i386\jvm.cfg Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_02879FBC push ds; retn 0000h 11_2_0287A026
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_0287DB61 push ecx; retn 0022h 11_2_0287DC16
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_0287D8A7 push es; iretd 11_2_0287D8AE
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DD8F7 push 00000000h; mov dword ptr [esp], esp 11_2_027DD921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DA21B push ecx; ret 11_2_027DA225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DA20A push ecx; ret 11_2_027DA21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DBB67 push 00000000h; mov dword ptr [esp], esp 11_2_027DBB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DB3B7 push 00000000h; mov dword ptr [esp], esp 11_2_027DB3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DD8D1 push 00000000h; mov dword ptr [esp], esp 11_2_027DD921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DB947 push 00000000h; mov dword ptr [esp], esp 11_2_027DB96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027DC477 push 00000000h; mov dword ptr [esp], esp 11_2_027DC49D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_0287F37D sldt word ptr [eax] 11_2_0287F37D
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 0000000B.00000002.2529316342.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 0000000B.00000002.2529316342.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 0000000B.00000002.2529316342.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Memory protected: page read and write | page guard Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 11_2_027D03C0 cpuid 11_2_027D03C0
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6608 VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs