Trojan.Siggen22.5496

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\ShTemporaryService6845177] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ShTemporaryService6845177] 'ImagePath' = '"%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe"'

Creates the following services

'ShTemporaryService6845177' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe"
'ShTemporaryService6845177' %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe

Modifies file system

Creates the following files

%APPDATA%\jwrapper-remote support\logs\wrapper-2023-11-13-16-37-08-818.log
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-autotest
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-jwrappermatchedversionserverunavailable
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-jwrapperjrecompatibilityapp
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-jwrapper_service_management_app
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-uninstallerico.icopng
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper_license
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappnote-jwrapperjrecompatibilityapp
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_arm-64.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\setsid
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shcad.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\cadasuser.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\winpty-agent.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\welcome.html
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\simplehelper.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_intel-32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_winpty_intel-32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_shpty_intel-32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_intel-64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_intel-64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_intel-64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil64
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_intel-32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_intel-32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_intel-32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_lion_intel-32.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\fontconfig.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-remote_support
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\customer-jar-with-dependencies.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\customer-jar-with-dependencies.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\da.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\openjsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\openjsse.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\legacy8ujsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\legacy8ujsse.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\cldrdata.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\cldrdata.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\access-bridge-64.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\access-bridge-64.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunmscapi.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunmscapi.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\rt.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\rt.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_intel-32.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_dxgi_intel-32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\third_party_readme
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\assembly_exception
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\disclaimer
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\license
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\windowslauncher.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\de.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\en.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\es.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\fr.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\it.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\nl.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\pt.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\sv.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunpkcs11.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\release
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_lion_intel-64.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_intel-64.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_arm-32.so
%APPDATA%\jwrapper-remote support\jwappssharedconfig\proxycredentials
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\83aa4cc77f591dfc2374580bbd95f6ba_d4602615-9d50-4880-be41-678935e93eaa
%TEMP%\imageio4686903345563956426.tmp
%TEMP%\imageio486209330050660032.tmp
%TEMP%\imageio4171364667978671335.tmp
%TEMP%\imageio9183364041828043011.tmp
%TEMP%\imageio9073864346234426707.tmp
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwrapper-remote support-splash.png
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\jwrapperusejre
%APPDATA%\jwrapper-remote support\jwapps\remote_supportico.ico
%APPDATA%\jwrapper-remote support\jwapps\chosenlanguage
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\unrestricted\jwlastrun
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwlastrun
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\unrestricted\jwlaunchproperties-1699922265189-1
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunpkcs11.jar.p2
%TEMP%\hsperfdata_user\2940
%APPDATA%\jwrapper-remote support\logs\remote support-remote support-2023-11-13-16-37-50-427-pid2940.log
%APPDATA%\jwrapper-remote support\jwapps\jre-lastsuccessfuloptions-jwrapper-windows64jre-00084000053-complete
%APPDATA%\jwrapper-remote support\jwappssharedconfig\basicinfo
%APPDATA%\jwrapper-remote support\jwappssharedconfig\branding\remotehelpuaccraucag80\applet_splash.png
%APPDATA%\jwrapper-remote support\jwappssharedconfig\branding\remotehelpuaccraucag80\branding.properties
%APPDATA%\jwrapper-remote support\jwappssharedconfig\branding\remotehelpuaccraucag80\applet_splash@2x.png
%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe
%ALLUSERSPROFILE%\simplehelp\elevatesh\elev_win.exe
%ALLUSERSPROFILE%\simplehelp\elevatesh\mmovelauncher8752758710995739823.service
%TEMP%\imageio1523576376664691353.tmp
%TEMP%\imageio7659610333601212074.tmp
%WINDIR%\temp\hsperfdata_glgojb$\104
%APPDATA%\jwrapper-remote support\jwappssharedconfig\detectedproxies
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_os_jwwin64
%APPDATA%\jwrapper-remote support\jwapps\jrenameoverride
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\remote supportwinlauncher.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_arm-32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_arm-32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil32arm
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_arm-64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_arm-64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_arm-64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil64arm
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\winpty-agent64.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\simplehelper64.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_dxgi_intel-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_intel-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_winpty_intel-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_shpty_intel-64.dll
%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\session elevation helper
%APPDATA%\jwrapper-remote support\logs\genericupdater-2023-11-13-16-37-37-009-pid0.log
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_macutilsarm
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_winutils32
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linutils64
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linutils32
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_macutils32
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_macutils64
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linarmutils32
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linarmutils64
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_winutils64
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-version.txt
%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\remote support.exe
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwlaunchproperties-3410172385-23
%TEMP%\hsperfdata_user\2204
%APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_interim
%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\unrestricted\jwlastrun
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\jaccess.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\sound.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\fontmanager.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\management.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jawt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jawtaccessbridge-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\awt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\hprof.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\java.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\javaw.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\dt_socket.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\nio.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\j2pkcs11.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\elev_win.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jsdt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\server\jvm.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\server\xusage.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\npt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jsoundds.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\net.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\pack200.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\msvcr100.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\freetype.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jpeg.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\lcms.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jli.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\w2k_lsa_auth.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\splashscreen.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\mlib_image.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\sunmscapi.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\dt_shmem.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwbuildversion
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapperlib\jwstandalonelaunch.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapperlib\jwstandalone.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-splash.png
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-icns.icns
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\elev_mac
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\session_win.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux64arm.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwutils_win32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux32arm.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwutils_win64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jsound.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\javaaccessbridge-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_macos.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\simpleservice.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauthorpublickey
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapperlaunch
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-jwrapper-version.txt
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\jwrapper-windows64jre-version.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jjs.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\zip.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\java.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jaas_nt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\windowsaccessbridge-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jdwp.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\sunec.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\nativesplash.png
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\verify.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\j2pcsc.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\instrument.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\limited\us_export_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\limited\local_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\unlimited\us_export_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\unlimited\local_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\cacerts
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\java.policy
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\java.security
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\openjsse.security
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\blacklisted.certs
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\legacy8ujsse.security
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\hijrah-config-umalqura.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\calendars.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\currency.data
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\logging.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\jaccess.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\fontconfig.properties.src
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\psfontj2d.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\tzmappings
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\linear_rgb.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\gray.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\pycc.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\ciexyz.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\srgb.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\crs-agent.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\crs-agent.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\charsets.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\charsets.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_movedrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\management.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\cursors.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\jmxremote.password.template
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\java-rmi.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\classpath_exception_note
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\readme.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\classlist
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\psfont.properties.ja
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\flavormap.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jce.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management-agent.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\meta-index
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\fontconfig.bfc
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\content-types.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jvm.hprof.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\resources.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jsse.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_linkdrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\snmp.acl.template
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\jmxremote.access
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\amd64\jvm.cfg
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\meta-index
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunjce_provider.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunec.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\tzdb.dat
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\accessibility.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\net.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_movenodrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_copynodrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\invalid32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_linknodrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_copydrop32x32.gif
%WINDIR%\temp\hsperfdata_glgojb$\3024

Deletes the following files

%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\crs-agent.jar.p2
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\unrestricted\jwlaunchproperties-1699922265189-1
%TEMP%\imageio9073864346234426707.tmp
%TEMP%\imageio9183364041828043011.tmp
%TEMP%\imageio4171364667978671335.tmp
%TEMP%\imageio486209330050660032.tmp
%TEMP%\imageio4686903345563956426.tmp
%APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_complete
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwlaunchproperties-3410172385-23
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\customer-jar-with-dependencies.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\rt.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunmscapi.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\access-bridge-64.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\cldrdata.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\legacy8ujsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\openjsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunpkcs11.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\jaccess.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\charsets.jar.p2
%TEMP%\imageio1523576376664691353.tmp
%TEMP%\imageio7659610333601212074.tmp

Moves the following files

from %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_interim to %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_complete

Network activity

Connects to

're####help.accra.ca':80
'localhost':49194
'localhost':49199

TCP

HTTP GET requests

http://re####help.accra.ca/customer/JWrapper-Windows64JRE-version.txt?ti#############
http://re####help.accra.ca/customer/JWrapper-Remote%20Support-version.txt
http://re####help.accra.ca/customer/JWrapper-JWrapper-version.txt
http://re####help.accra.ca/server_side_parameters
http://re####help.accra.ca/translations_user/en.txt
http://re####help.accra.ca/branding/brandingfiles?a=#
http://re####help.accra.ca/branding/applet_splash.png?a=#
http://re####help.accra.ca/branding/branding.properties?a=#

Other

'localhost':49193
'localhost':49197
'localhost':49198

UDP

DNS ASK re####help.accra.ca

Miscellaneous

Creates and executes the following

'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\crs-agent.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\crs-agent.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\rt.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\rt.jar"
'%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' -uninstallbyname ShTemporaryService6845177
'%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe'
'%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' "-install" "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\MMoveLauncher8752758710995739823.service"
'%ALLUSERSPROFILE%\simplehelp\elevatesh\elev_win.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe" "-install" "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\MMoveLauncher8752758710995739823.service"
'%ALLUSERSPROFILE%\simplehelp\elevatesh\elev_win.exe' %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\elev_win.exe %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe -install %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\MMoveLauncher8752758710995739823.ser...
'%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\remote support.exe' -cp "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00102236241-complete\customer-jar-with-dependencies.jar" -Xmx512m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.ut...
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\windowslauncher.exe' "-Xshare:dump"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunmscapi.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunmscapi.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\legacy8ujsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\legacy8ujsse.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\openjsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\openjsse.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunpkcs11.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunpkcs11.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\jaccess.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\jaccess.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\jsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\jsse.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\charsets.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\charsets.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\access-bridge-64.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\access-bridge-64.jar"
'%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\session elevation helper' -cp "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00102236241-complete\customer-jar-with-dependencies.jar" -Xmx128m -Xms5m -Dsun.java2d.dpiaware=true "-Djava.library.path=%APPDATA%...
'%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\cldrdata.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\cldrdata.jar"
'%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' -uninstallbyname ShTemporaryService6845177' (with hidden window)
'%APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\session_win.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-Windows64JRE-00084000053-complete\bin\windowslauncher.exe" "-cp" "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00102236241-complete\cust...' (with hidden window)

Executes the following

'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp" /t /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH" /t /c /grant *S-1-5-32-545:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\*.*" /t /c /grant *S-1-1-0:(OI)(CI)F

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial