Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ShTemporaryService6845177] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ShTemporaryService6845177] 'ImagePath' = '"%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe"'
Creates the following services
- 'ShTemporaryService6845177' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe"
- 'ShTemporaryService6845177' %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe
Modifies file system
Creates the following files
- %APPDATA%\jwrapper-remote support\logs\wrapper-2023-11-13-16-37-08-818.log
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-autotest
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-jwrappermatchedversionserverunavailable
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-jwrapperjrecompatibilityapp
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-jwrapper_service_management_app
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-uninstallerico.icopng
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper_license
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappnote-jwrapperjrecompatibilityapp
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_arm-64.jnilib
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\setsid
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shcad.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\cadasuser.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\winpty-agent.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\welcome.html
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\simplehelper.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_intel-32.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_winpty_intel-32.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_shpty_intel-32.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_intel-64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_intel-64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_intel-64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil64
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_intel-32.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_intel-32.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_intel-32.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_lion_intel-32.jnilib
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\fontconfig.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwappspec-remote_support
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\customer-jar-with-dependencies.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\customer-jar-with-dependencies.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\da.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\openjsse.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\openjsse.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\legacy8ujsse.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\legacy8ujsse.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\cldrdata.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\cldrdata.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\access-bridge-64.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\access-bridge-64.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunmscapi.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunmscapi.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\rt.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\rt.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_intel-32.jnilib
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_dxgi_intel-32.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\third_party_readme
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\assembly_exception
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\disclaimer
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\license
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\windowslauncher.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\de.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\en.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\es.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\fr.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\it.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\nl.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\pt.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\translations\sv.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunpkcs11.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\release
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_lion_intel-64.jnilib
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_mnative_intel-64.jnilib
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_arm-32.so
- %APPDATA%\jwrapper-remote support\jwappssharedconfig\proxycredentials
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\83aa4cc77f591dfc2374580bbd95f6ba_d4602615-9d50-4880-be41-678935e93eaa
- %TEMP%\imageio4686903345563956426.tmp
- %TEMP%\imageio486209330050660032.tmp
- %TEMP%\imageio4171364667978671335.tmp
- %TEMP%\imageio9183364041828043011.tmp
- %TEMP%\imageio9073864346234426707.tmp
- %APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwrapper-remote support-splash.png
- %APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\jwrapperusejre
- %APPDATA%\jwrapper-remote support\jwapps\remote_supportico.ico
- %APPDATA%\jwrapper-remote support\jwapps\chosenlanguage
- %APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\unrestricted\jwlastrun
- %APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwlastrun
- %APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\unrestricted\jwlaunchproperties-1699922265189-1
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunpkcs11.jar.p2
- %TEMP%\hsperfdata_user\2940
- %APPDATA%\jwrapper-remote support\logs\remote support-remote support-2023-11-13-16-37-50-427-pid2940.log
- %APPDATA%\jwrapper-remote support\jwapps\jre-lastsuccessfuloptions-jwrapper-windows64jre-00084000053-complete
- %APPDATA%\jwrapper-remote support\jwappssharedconfig\basicinfo
- %APPDATA%\jwrapper-remote support\jwappssharedconfig\branding\remotehelpuaccraucag80\applet_splash.png
- %APPDATA%\jwrapper-remote support\jwappssharedconfig\branding\remotehelpuaccraucag80\branding.properties
- %APPDATA%\jwrapper-remote support\jwappssharedconfig\branding\remotehelpuaccraucag80\applet_splash@2x.png
- %ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe
- %ALLUSERSPROFILE%\simplehelp\elevatesh\elev_win.exe
- %ALLUSERSPROFILE%\simplehelp\elevatesh\mmovelauncher8752758710995739823.service
- %TEMP%\imageio1523576376664691353.tmp
- %TEMP%\imageio7659610333601212074.tmp
- %WINDIR%\temp\hsperfdata_glgojb$\104
- %APPDATA%\jwrapper-remote support\jwappssharedconfig\detectedproxies
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_os_jwwin64
- %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\remote supportwinlauncher.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_arm-32.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_arm-32.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil32arm
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_base_arm-64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_grab_arm-64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libutils_lnative_wlgrab_arm-64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\shlinuxutil64arm
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\winpty-agent64.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\simplehelper64.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_dxgi_intel-64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_intel-64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_winpty_intel-64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\utils_wnative_shpty_intel-64.dll
- %APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\session elevation helper
- %APPDATA%\jwrapper-remote support\logs\genericupdater-2023-11-13-16-37-37-009-pid0.log
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_macutilsarm
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_winutils32
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linutils64
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linutils32
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_macutils32
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_macutils64
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linarmutils32
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_linarmutils64
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauxiliaryarchive-remote support_winutils64
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-version.txt
- %APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\remote support.exe
- %APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwlaunchproperties-3410172385-23
- %TEMP%\hsperfdata_user\2204
- %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_interim
- %APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\unrestricted\jwlastrun
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\jaccess.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\sound.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\fontmanager.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\management.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jawt.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jawtaccessbridge-64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\awt.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\hprof.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\java.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\javaw.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\dt_socket.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\nio.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\j2pkcs11.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\elev_win.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jsdt.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\server\jvm.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\server\xusage.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\npt.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jsoundds.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\net.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\pack200.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\msvcr100.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\freetype.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jpeg.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\lcms.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jli.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\w2k_lsa_auth.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\splashscreen.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\mlib_image.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\sunmscapi.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\dt_shmem.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwbuildversion
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapperlib\jwstandalonelaunch.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapperlib\jwstandalone.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-splash.png
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-remote support-icns.icns
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\elev_mac
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\session_win.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux64arm.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwutils_win32.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux32arm.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwutils_win64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux64.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jsound.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\javaaccessbridge-64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_macos.jnilib
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\simpleservice.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwauthorpublickey
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapperlaunch
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\jwrapper-jwrapper-version.txt
- %APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\jwrapper-windows64jre-version.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jjs.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\zip.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\java.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jaas_nt.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\windowsaccessbridge-64.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\jdwp.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\sunec.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\nativesplash.png
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\libjwutils_linux32.so
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\verify.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\j2pcsc.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\instrument.dll
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\limited\us_export_policy.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\limited\local_policy.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\unlimited\us_export_policy.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\policy\unlimited\local_policy.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\cacerts
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\java.policy
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\java.security
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\openjsse.security
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\blacklisted.certs
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\security\legacy8ujsse.security
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\hijrah-config-umalqura.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\calendars.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\currency.data
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\logging.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\jaccess.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\fontconfig.properties.src
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\psfontj2d.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\tzmappings
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\linear_rgb.pf
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\gray.pf
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\pycc.pf
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\ciexyz.pf
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\cmm\srgb.pf
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\crs-agent.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\crs-agent.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\charsets.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\charsets.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jsse.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_movedrop32x32.gif
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\management.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\cursors.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\jmxremote.password.template
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\java-rmi.exe
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\classpath_exception_note
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\readme.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\classlist
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\psfont.properties.ja
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\flavormap.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jce.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management-agent.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\meta-index
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\fontconfig.bfc
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\content-types.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jvm.hprof.txt
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\resources.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jsse.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_linkdrop32x32.gif
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\snmp.acl.template
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\management\jmxremote.access
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\amd64\jvm.cfg
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\meta-index
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunjce_provider.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunec.jar
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\tzdb.dat
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\accessibility.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\net.properties
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_movenodrop32x32.gif
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_copynodrop32x32.gif
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\invalid32x32.gif
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_linknodrop32x32.gif
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\images\cursors\win32_copydrop32x32.gif
- %WINDIR%\temp\hsperfdata_glgojb$\3024
Deletes the following files
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\crs-agent.jar.p2
- %APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\unrestricted\jwlaunchproperties-1699922265189-1
- %TEMP%\imageio9073864346234426707.tmp
- %TEMP%\imageio9183364041828043011.tmp
- %TEMP%\imageio4171364667978671335.tmp
- %TEMP%\imageio486209330050660032.tmp
- %TEMP%\imageio4686903345563956426.tmp
- %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_complete
- %APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00102236230-complete\unrestricted\jwlaunchproperties-3410172385-23
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922228-5-app\customer-jar-with-dependencies.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\rt.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunmscapi.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\access-bridge-64.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\cldrdata.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\legacy8ujsse.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\openjsse.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\sunpkcs11.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\ext\jaccess.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\jsse.jar.p2
- %APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\lib\charsets.jar.p2
- %TEMP%\imageio1523576376664691353.tmp
- %TEMP%\imageio7659610333601212074.tmp
Moves the following files
- from %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_interim to %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_complete
Network activity
Connects to
- 're####help.accra.ca':80
- 'localhost':49194
- 'localhost':49199
TCP
HTTP GET requests
- http://re####help.accra.ca/customer/JWrapper-Windows64JRE-version.txt?ti#############
- http://re####help.accra.ca/customer/JWrapper-Remote%20Support-version.txt
- http://re####help.accra.ca/customer/JWrapper-JWrapper-version.txt
- http://re####help.accra.ca/server_side_parameters
- http://re####help.accra.ca/translations_user/en.txt
- http://re####help.accra.ca/branding/brandingfiles?a=#
- http://re####help.accra.ca/branding/applet_splash.png?a=#
- http://re####help.accra.ca/branding/branding.properties?a=#
Other
- 'localhost':49193
- 'localhost':49197
- 'localhost':49198
UDP
- DNS ASK re####help.accra.ca
Miscellaneous
Creates and executes the following
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\crs-agent.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\crs-agent.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\rt.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\rt.jar"
- '%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' -uninstallbyname ShTemporaryService6845177
- '%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe'
- '%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' "-install" "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\MMoveLauncher8752758710995739823.service"
- '%ALLUSERSPROFILE%\simplehelp\elevatesh\elev_win.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe" "-install" "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\MMoveLauncher8752758710995739823.service"
- '%ALLUSERSPROFILE%\simplehelp\elevatesh\elev_win.exe' %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\elev_win.exe %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\SimpleService.exe -install %ALLUSERSPROFILE%\SimpleHelp\ElevateSH\MMoveLauncher8752758710995739823.ser...
- '%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\remote support.exe' -cp "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00102236241-complete\customer-jar-with-dependencies.jar" -Xmx512m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.ut...
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\windowslauncher.exe' "-Xshare:dump"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunmscapi.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunmscapi.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\legacy8ujsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\legacy8ujsse.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\openjsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\openjsse.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunpkcs11.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\sunpkcs11.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\jaccess.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\jaccess.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\jsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\jsse.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\charsets.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\charsets.jar"
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\access-bridge-64.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\access-bridge-64.jar"
- '%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00084000053-complete\bin\session elevation helper' -cp "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00102236241-complete\customer-jar-with-dependencies.jar" -Xmx128m -Xms5m -Dsun.java2d.dpiaware=true "-Djava.library.path=%APPDATA%...
- '%APPDATA%\jwrapper-remote support\jwrappertemp-1699922231-6-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\cldrdata.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1699922231-6-app\lib\ext\cldrdata.jar"
- '%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' -uninstallbyname ShTemporaryService6845177' (with hidden window)
- '%APPDATA%\jwrapper-remote support\jwrapper-remote support-00102236241-complete\session_win.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-Windows64JRE-00084000053-complete\bin\windowslauncher.exe" "-cp" "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00102236241-complete\cust...' (with hidden window)
Executes the following
- '<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp" /t /c /grant *S-1-1-0:(OI)(CI)F
- '<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH" /t /c /grant *S-1-5-32-545:(OI)(CI)F
- '<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\*.*" /t /c /grant *S-1-1-0:(OI)(CI)F
