Windows Analysis Report
12-09-2022 S#U0130PAR#U0130#U015e.docx.doc

Overview

General Information

Sample Name: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc
Analysis ID: 701320
MD5: 7e8133cf5f56adcfafb9bc91390c9fe7
SHA1: 2cc6471245901e51565ad69df6b8586629965cf1
SHA256: 7859fd95c60a0d76fa99eb42277501b20f76a377c1395b504acff5dd22533027
Tags: doc
Infos:

Detection

AdWind
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (creates forbidden files)
Multi AV Scanner detection for submitted file
Yara detected AdWind RAT
Document contains OLE streams which likely are hidden ActiveX objects
Document exploit detected (process start blacklist hit)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Found inlined nop instructions (likely shell or obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Detected potential crypto function
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Document misses a certain OLE stream usually present in this Microsoft Office document type
Abnormal high CPU Usage

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc ReversingLabs: Detection: 26%
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc Virustotal: Detection: 17% Perma Link
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Software Vulnerabilities
barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\a0v2H8.jar Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 5x nop then dec eax 3_2_02A10237
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 5x nop then dec eax 10_2_029E1477
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/3
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/;
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/allow-java-encodings9
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error=
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes:
Source: javaw.exe, 00000003.00000002.1007607362.000000005912A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961135410.0000000059112000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967577855.000000005911F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1018446449.00000000591B3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1014550524.00000000591AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1008158290.0000000059149000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.991312019.00000000590C9000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1063932993.00000000591BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl#
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes?
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion3
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion9
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace/
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations9
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations;
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/include-comments
Source: javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/include-comments0
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/include-commentsc
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/parser-settings7
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/parser-settingss8q
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicates
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicatesO
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicatesY
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only/
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/namespace-growth
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/namespace-growthK
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd:
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs7
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs3
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refsC
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/standard-uri-conformantK
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/standard-uri-conformanter2
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validate-annotationss
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-treesK
Source: javaw.exe, 00000003.00000003.962091806.0000000059B79000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.966769903.0000000059B80000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.956399008.0000000059B48000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008163731.0000000059B80000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1018446449.00000000591B3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1014550524.00000000591AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1008158290.0000000059149000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.991312019.00000000590C9000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1063932993.00000000591BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-treesdSkip
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/dynamicK
Source: javaw.exe, 00000003.00000003.962091806.0000000059B79000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.966769903.0000000059B80000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.956399008.0000000059B48000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008163731.0000000059B80000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1018446449.00000000591B3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1014550524.00000000591AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1008158290.0000000059149000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.991312019.00000000590C9000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1063932993.00000000591BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/dynamictURI
Source: javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking=
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checkingP
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psviK
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvic
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/element-defaultA
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-valueB
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdefD
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef:
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdefs
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris6
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language;
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-languageS
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xinclude1
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/features/xincludec
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/D
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node9
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name$
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/input-buffer-sizeternal
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory:
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factoryK
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner7
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/document-scannerk
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor5
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor;
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner8
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager8
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver1
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver7
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-handler6
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter:
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool#4p
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool6
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context:
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-contextV
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-contextV:
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/namespace-contextk5p
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolvere;)V
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/symbol-tableQ
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation-managerF
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory7
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd:
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler9
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/locale
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/localeJ
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation;
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation(
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/security-manager
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/properties/security-manager8
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypes
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypesnEvent
Source: javaw.exe, 00000003.00000002.1048681741.00000000D7615000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1010127537.00000000D5580000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1067403383.00000000D5580000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 00000003.00000003.962713926.0000000059BA0000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964855770.0000000059A6F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962091806.0000000059B79000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1048874613.00000000D763A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.966236710.0000000059A76000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008117482.0000000059A95000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1046320748.00000000D745E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1046522557.00000000D747C000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.966642599.0000000059A95000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.958316594.0000000059A6F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.956399008.0000000059B48000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1115594736.00000000D7648000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1006410957.000000005984C000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1107668636.00000000D7424000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ipinfo.io/
Source: javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ipinfo.io/&
Source: javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ipinfo.io/ip
Source: javaw.exe, 00000003.00000003.958316594.0000000059A6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ipinfo.io/ipX
Source: javaw.exe, 00000003.00000002.1048681741.00000000D7615000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1010127537.00000000D5580000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/
Source: javaw.exe, 0000000A.00000002.1067403383.00000000D5580000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/sha
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1048641447.00000000D7608000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1109407547.00000000D755D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1107668636.00000000D7424000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1109311234.00000000D7549000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/dtd/properties.dtd
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/dtd/properties.dtd3
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/dom/properties/
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/dom/properties/(
Source: javaw.exe, 00000003.00000003.966821739.0000000059CA4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1048041021.00000000D7561000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967357824.0000000059CA4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008328551.0000000059CA4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1109407547.00000000D755D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1065071207.0000000059885000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1006601184.000000005986D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage4
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguagec
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource
Source: javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource7
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/k
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace0
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace;
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtdV
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state#
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-stateeFromDO
Source: javaw.exe, 00000003.00000002.1007607362.000000005912A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961135410.0000000059112000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967577855.000000005911F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1018446449.00000000591B3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1014550524.00000000591AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1008158290.0000000059149000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.991312019.00000000590C9000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1063932993.00000000591BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/feature/secure-processing
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD;
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTDs
Source: javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchema
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchemaD
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchemas3p
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/e3
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://javax.xml.XMLConstants/property/sRv
Source: javaw.exe, 00000003.00000002.1046522557.00000000D747C000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/feature/use-service-mechanismjectI
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/feature/use-service-mechanismkTv
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementAttributeLimit
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimithe/xerces/
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityReplacementLimit
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/getEntityCountInfo
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/java/io/Object
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxElementDepth
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxElementDepths
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimitc3r
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxOccurLimit
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1009441017.0000000059731000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1002287620.00000000596C2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064752540.0000000059731000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit
Source: javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager
Source: javaw.exe, 00000003.00000002.1048181873.00000000D7576000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD=
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-general-entities7
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-general-entitiesS
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces&
Source: javaw.exe, 00000003.00000003.963573067.000000005900B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.967436542.000000005901A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962440979.0000000058FFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960930096.0000000058FC6000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/tream$PutFie
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: javaw.exe, 00000003.00000003.967137901.0000000058DE3000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.961343704.0000000058DB2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.963476262.0000000058DD5000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1006841983.0000000058DEB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.962280568.0000000058DCE000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.965067072.0000000058DDC000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.989124167.00000000591DB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1064044169.0000000059262000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/validation
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/
Source: javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/(
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/C
Source: javaw.exe, 00000003.00000003.966664801.0000000059A11000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964657582.00000000599EA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.960812434.00000000599CA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1049410615.00000000D7693000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000003.00000003.964787205.0000000059A0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000003.00000002.1008031716.0000000059A19000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.987388038.0000000059ABA000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.1116728587.00000000D76EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: javaw.exe, 00000003.00000002.1047788279.00000000D7534000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/properties/xml-string;
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D9320A51-5E17-41AC-AA14-257027C1CCDA}.tmp Jump to behavior

System Summary
barindex
Document contains OLE streams which likely are hidden ActiveX objects
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc Stream path '\x1Ole10Native' : ....a0v2H8.jar.C:\Users\MICROSOFT\AppData\Local\Mi
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr Stream path '_1724495465/\x1Ole10Native' : ....a0v2H8.jar.C:\Users\MICROSOFT\AppData\Local\Mi
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr Stream path '_1724495487/\x1Ole10Native' : 4....a0v2H8.jar.C:\Users\MICROSOFT\AppData\Local\M
Detected potential crypto function
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 3_2_029336A1 3_2_029336A1
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 3_2_029344C9 3_2_029344C9
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 3_2_02A0AB3C 3_2_02A0AB3C
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 3_2_02A0A6B7 3_2_02A0A6B7
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 3_2_02A0AFC3 3_2_02A0AFC3
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 3_2_02A0B481 3_2_02A0B481
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 10_2_029036A1 10_2_029036A1
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Code function: 10_2_029044C9 10_2_029044C9
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Abnormal high CPU Usage
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process Stats: CPU usage > 98%
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc ReversingLabs: Detection: 26%
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc Virustotal: Detection: 17%
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe "C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\a0v2H8.jar"
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic CPU get ProcessorId
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get name
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe "C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\a0v2H8.jar"
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic CPU get ProcessorId
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get name
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe "C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\a0v2H8.jar" Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe "C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\a0v2H8.jar" Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic CPU get ProcessorId Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get name Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic CPU get ProcessorId Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get name Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\12-09-2022 S#U0130PAR#U0130#U015e.docx.doc
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc OLE indicator, Word Document stream: true
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$-09-2022 S#U0130PAR#U0130#U015e.docx.doc Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR4FF3.tmp Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Section loaded: C:\Program Files\Java\jre1.8.0_121\bin\server\jvm.dll Jump to behavior
Source: classification engine Classification label: mal80.troj.expl.evad.winDOC@21/13@0/0
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc OLE document summary: title field not present or empty
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc Initial sample: OLE zip file path = word/media/image3.emf
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: 12-09-2022 S#U0130PAR#U0130#U015e.docx.doc Stream path '\x1Ole10Native' entropy: 7.99740193304 (max. 8.0)
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr Stream path '_1724495465/\x1Ole10Native' entropy: 7.99740193304 (max. 8.0)
Source: ~WRF{D598F5A9-41E1-44C7-8D38-8B82E1D2FAA1}.tmp.0.dr Stream path '_1724495487/\x1Ole10Native' entropy: 7.9976081212 (max. 8.0)

Malware Analysis System Evasion
barindex
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT SerialNumber FROM Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT SerialNumber FROM Win32_BIOS
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wbem\WMIC.exe TID: 1832 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2448 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 1696 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2960 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2420 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2156 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 1516 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2324 Thread sleep time: -240000s >= -30000s
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT ProcessorId FROM WIN32_PROCESSOR
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT ProcessorId FROM WIN32_PROCESSOR
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT Name FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT Name FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - SELECT UUID FROM Win32_ComputerSystemProduct
Source: javaw.exe, 0000000A.00000002.1068786516.00000000D56B8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware Virtual Platform
Source: WMIC.exe, 00000008.00000002.975345271.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <COMMAND SEQUENCENUM="1" ISSUEDFROM="936905" STARTTIME="09-12-2022T13:45:50" EVERYCOUNT="0"><REQUEST><COMMANDLINE> csproduct get name</COMMANDLINE><COMMANDLINECOMPONENTS><NODELIST><NODE>936905</NODE></NODELIST></COMMANDLINECOMPONENTS><CONTEXT><NAMESPACE>root\cimv2</NAMESPACE><ROLE>root\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT></REQUEST><RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS></COMMAND>[
Source: WMIC.exe, 00000008.00000003.973097257.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <COMMAND SEQUENCENUM="1" ISSUEDFROM="936905" STARTTIME="09-12-2022T13:45:50" EVERYCOUNT="0"><REQUEST><COMMANDLINE> csproduct get name</COMMANDLINE><COMMANDLINECOMPONENTS><NODELIST><NODE>936905</NODE></NODELIST></COMMANDLINECOMPONENTS><CONTEXT><NAMESPACE>root\cimv2</NAMESPACE><ROLE>root\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT></REQUEST><RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS>
Source: WMIC.exe, 00000008.00000003.973024787.000000000047F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .VMware Virtual Platform\\
Source: javaw.exe, 0000000A.00000002.1068786516.00000000D56B8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware Virtual Platform
Source: javaw.exe, 00000003.00000002.984671724.00000000022E7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000003.00000002.1011501630.00000000D56B8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: PVMware Virtual Platform
Source: javaw.exe, 0000000A.00000003.973327945.00000000575B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: WMIC.exe, 00000008.00000002.975345271.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: rMMAND SEQUENCENUM="1" ISSUEDFROM="936905" STARTTIME="09-12-2022T13:45:50" EVERYCOUNT="0"><REQUEST><COMMANDLINE> csproduct get name</COMMANDLINE><COMMANDLINECOMPONENTS><NODELIST><NODE>936905</NODE></NODELIST></COMMANDLINECOMPONENTS><CONTEXT><NAMESPACE>root\cimv2</NAMESPACE><ROLE>root\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT></REQUEST><RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS></COMMAND>
Source: javaw.exe, 00000003.00000003.943495510.0000000057640000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: WMIC.exe, 00000008.00000002.975193932.0000000000494000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C.VMware Virtual Platform
Source: WMIC.exe, 00000008.00000002.975345271.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS>
Source: WMIC.exe, 00000008.00000003.973097257.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM>
Source: WMIC.exe, 00000008.00000003.973024787.000000000047F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_ComputerSystemProductVMware Virtual Platform.22
Source: WMIC.exe, 00000008.00000002.974919623.000000000047F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS>oot\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT>
Source: javaw.exe, 0000000A.00000003.973327945.00000000575B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000003.00000002.984671724.00000000022E7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError
Source: WMIC.exe, 00000008.00000003.973024787.000000000047F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 6VMware Virtual Platform
Source: javaw.exe, 0000000A.00000003.973327945.00000000575B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: WMIC.exe, 00000008.00000002.975193932.0000000000494000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: /.VMware Virtual Platform
Source: WMIC.exe, 00000008.00000003.973097257.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <COMMAND SEQUENCENUM="1" ISSUEDFROM="936905" STARTTIME="09-12-2022T13:45:50" EVERYCOUNT="0"><REQUEST><COMMANDLINE> csproduct get name</COMMANDLINE><COMMANDLINECOMPONENTS><NODELIST><NODE>936905</NODE></NODELIST></COMMANDLINECOMPONENTS><CONTEXT><NAMESPACE>root\cimv2</NAMESPACE><ROLE>root\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT></REQUEST><RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS></COMMAND>
Source: javaw.exe, 0000000A.00000002.1068786516.00000000D56B8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: #VMware Virtual Platform#
Source: WMIC.exe, 00000008.00000002.975345271.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM>ystem32\cmo
Source: WMIC.exe, 00000008.00000002.975345271.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <COMMAND SEQUENCENUM="1" ISSUEDFROM="936905" STARTTIME="09-12-2022T13:45:50" EVERYCOUNT="0"><REQUEST><COMMANDLINE> csproduct get name</COMMANDLINE><COMMANDLINECOMPONENTS><NODELIST><NODE>936905</NODE></NODELIST></COMMANDLINECOMPONENTS><CONTEXT><NAMESPACE>root\cimv2</NAMESPACE><ROLE>root\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT></REQUEST><RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS>h
Source: WMIC.exe, 00000008.00000002.975345271.00000000004B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM>
Source: WMIC.exe, 00000008.00000003.973024787.000000000047F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .VMware Virtual Platform
Source: WMIC.exe, 00000008.00000003.973216204.000000000047F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <RESULTS NODE="936905"><CIM><INSTANCE CLASSNAME="Win32_ComputerSystemProduct"><PROPERTY NAME="Name" TYPE="string"><VALUE>VMware Virtual Platform</VALUE></PROPERTY></INSTANCE></CIM></RESULTS>oot\cli</ROLE><IMPLEVEL>IMPERSONATE</IMPLEVEL><AUTHLEVEL>PKTPRIVACY</AUTHLEVEL><LOCALE>ms_409</LOCALE><PRIVILEGES>ENABLE</PRIVILEGES><TRACE>OFF</TRACE><RECORD>N/A</RECORD><INTERACTIVE>OFF</INTERACTIVE><FAILFAST>OFF</FAILFAST><OUTPUT>STDOUT</OUTPUT><APPEND>STDOUT</APPEND><USER>N/A</USER><AGGREGATE>ON</AGGREGATE></CONTEXT>j
Source: WMIC.exe, 00000008.00000003.974219765.000000000240B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_ComputerSystemProductVMware Virtual Platformk
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Memory protected: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic CPU get ProcessorId Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get name Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic CPU get ProcessorId Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get name Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_121\bin\javaw.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AdWind RAT
Source: Yara match File source: 0000000A.00000002.1107491922.00000000D7403000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1046522557.00000000D747C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1108130731.00000000D7479000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1045659100.00000000D7407000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1316, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AdWind RAT
Source: Yara match File source: 0000000A.00000002.1107491922.00000000D7403000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1046522557.00000000D747C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1108130731.00000000D7479000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1045659100.00000000D7407000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: javaw.exe PID: 1316, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 701320 Sample: 12-09-2022 S#U0130PAR#U0130... Startdate: 12/09/2022 Architecture: WINDOWS Score: 80 34 Document contains OLE streams which likely are hidden ActiveX objects 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected AdWind RAT 2->38 40 Document exploit detected (process start blacklist hit) 2->40 7 WINWORD.EXE 310 42 2->7         started        process3 file4 32 C:\Users\user\AppData\Local\Temp\a0v2H8.jar, Zip 7->32 dropped 42 Document exploit detected (creates forbidden files) 7->42 11 javaw.exe 2 7->11         started        13 javaw.exe 2 7->13         started        signatures5 process6 process7 15 WMIC.exe 11->15         started        18 WMIC.exe 11->18         started        20 WMIC.exe 11->20         started        22 WMIC.exe 11->22         started        24 WMIC.exe 13->24         started        26 WMIC.exe 13->26         started        28 WMIC.exe 13->28         started        30 WMIC.exe 13->30         started        signatures8 44 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->44
⊘No contacted IP infos