Trojan.Siggen34.1909

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\Remote Access Service] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\Remote Access Service] 'ImagePath' = '"%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"'

Creates the following services

'Remote Access Service' %ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig estricted\SimpleService.exe
'Remote Access Service' %ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe

Malicious functions

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=%ALLUSERSPROFIL...
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=%ALLUSERSPROFILE%\JWrapper-Re...
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=%ALLUSER...

Modifies file system

Creates the following files

%TEMP%\ert_001f1c88\payload.zip
%TEMP%\ert_001f1c88\x\built.exe
%TEMP%\ert_001f1c88\x\elev_helper.exe
%TEMP%\ert_001f1c88\x\manifest.json
%TEMP%\ert_001f1c88\x\veritt-launcher.exe
%LOCALAPPDATA%\autoelevator\runtime\built.exe
%LOCALAPPDATA%\autoelevator\runtime\elev_helper.exe
%LOCALAPPDATA%\autoelevator\runtime\veritt-launcher.exe
%LOCALAPPDATA%\autoelevator\runtime\.data\target.exe
%ALLUSERSPROFILE%\jwrapper-remote access\logs\wrapper-2026-09-06-22-04-26-489.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\nativesplash.png
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwbuildversion
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwrapperlib\jwstandalonelaunch.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwagent.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwrapperlib\jwstandalone.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwrapper-remote access-splash.png
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwrapper-remote access-icns.icns
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwutils_win64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\libjwutils_linux64arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\libjwutils_linux64.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\libjwutils_linux32arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\elev_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\elev_mac
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\libjwutils_linux32.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\session_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwutils_win32.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\libjwutils_macos.jnilib
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\simpleservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwauthorpublickey
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwrapperlaunch
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757466-2-app\jwrapper-jwrapper-version.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-jwrapper-00115411574-complete\jwrapper-windows64jre-version.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\vcruntime140_1.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-localization-l1-2-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\freetype.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\java.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\java.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-timezone-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-heap-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\mlib_image.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-time-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-console-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-conio-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\fontmanager.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-handle-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-file-l1-2-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-processenvironment-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-utility-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-libraryloader-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-synch-l1-2-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\management.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\awt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-datetime-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-file-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-errorhandling-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\jaccessinspector.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\attach.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\jsound.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-debug-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-fibers-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-heap-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-sysinfo-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-locale-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-multibyte-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\jaccesswalker.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-file-l2-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\management_ext.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\jimage.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-namedpipe-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-environment-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-stdio-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-profile-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\msvcp140.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\lcms.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\splashscreen.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-util-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\windowsaccessbridge-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-string-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\net.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-processthreads-l1-1-1.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\verify.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\j2pkcs11.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\server\jvm.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-console-l1-2-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\javaaccessbridge.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\instrument.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-synch-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-math-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-runtime-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\vcruntime140.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\nio.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-filesystem-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\prefs.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\zip.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\javajpeg.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-string-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-private-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\jawt.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-convert-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-memory-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\javaw.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\ucrtbase.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-interlocked-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-core-processthreads-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\api-ms-win-crt-process-l1-1-0.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\jli.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\net.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\sound.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\fonts\fontconfig.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\java.security
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\java.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\policy\readme.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\policy\unlimited\default_us_export.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\policy\unlimited\default_local.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\policy\limited\default_us_export.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\policy\limited\default_local.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\security\policy\limited\exempt_local.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\conf\logging.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.cryptoki\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.cryptoki\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.cryptoki\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.accessibility\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.accessibility\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.accessibility\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\bcel.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\xerces.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\jcup.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\dom.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\xalan.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.xml\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.naming\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.naming\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.naming\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.management\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.management\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.management\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.logging\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.logging\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.logging\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.management\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.management\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.management\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.datatransfer\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.datatransfer\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.datatransfer\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.internal.jvmstat\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.internal.jvmstat\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.internal.jvmstat\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\harfbuzz.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\jpeg.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\colorimaging.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\libpng.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\lcms.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\freetype.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\giflib.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.desktop\mesa3d.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.ec\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.ec\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.crypto.ec\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.prefs\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.prefs\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.prefs\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\c-libutl.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\asm.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\icu.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\zlib.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\aes.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\cldr.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\public_suffix.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\unicode.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.base\wepoll.md
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.attach\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.attach\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\jdk.attach\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.instrument\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.instrument\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.instrument\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.security.sasl\additional_license_info
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.security.sasl\license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\legal\java.security.sasl\assembly_exception
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\psfontj2d.properties
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\jvm.cfg
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\modules
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\jrt-fs.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\fontconfig.bfc
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\psfont.properties.ja
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\tzmappings
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\jawt.lib
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\fontconfig.properties.src
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\tzdb.dat
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\security\blocked.certs
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\security\default.policy
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\security\public_suffix_list.dat
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\security\cacerts
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\jvm.lib
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\lib\classlist
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\release
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\windowslauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\de
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\en
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\es
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\fr
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\it
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\nl
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\pt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\sv
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\translations\da
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\remoteaccess-jar-with-dependencies.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-jwrapperjrecompatibilityapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_access_configure
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_access_restart
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_access_service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_access_launcher
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-permissions
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_access_session
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-stop_remote_access_service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-manage_remote_access_service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-autotest
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-headlesstest
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_access_monitoring
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-remote_work_setup
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-jwrapperpostinstallapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-jwrapperpostuninstallapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-update
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappspec-jwrapper_service_management_app
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwrapper-remote access-splash.png
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwrapper-remote access-icns.icns
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwrapper-remote access-uninstallerico.icopng
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwrapper_license
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwappnote-jwrapperjrecompatibilityapp
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwbuildversion
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\libjwutils_linux64arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\libjwutils_linux32.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\libjwutils_linux32arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\libjwutils_linux64.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\libjwutils_macos.jnilib
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\elev_mac
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\session_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\elev_win.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwutils_win64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwutils_win32.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwrapperlaunch
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\shcad.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\simpleservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\winpty-agent64.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\simplehelper64.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\utils_wnative_dxgi_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\utils_wnative_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\utils_wnative_winpty_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\utils_wnative_shpty_intel-64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\libzstd-jni.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\cadasuser.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\remote accesswinlauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwauxiliaryarchive-remote access_os_jwwin64
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwauxiliaryarchive-remote access_winutils64
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757472-4-app\jwrapper-remote access-version.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\jwrapperlib\jwstandalonelaunch.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\jwagent.jar
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\jwrapperlaunch
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\jwutils_win32.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\jwutils_win64.dll
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\libjwutils_linux32.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\libjwutils_linux32arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\libjwutils_linux64.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\libjwutils_linux64arm.so
%ALLUSERSPROFILE%\jwrapper-remote access\jwrappertemp-1788757473-6-app\libjwutils_macos.jnilib
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-windows64jre-00115399100-complete\bin\remote access.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-jwrapper-00115411574-complete\unrestricted\jwlaunchproperties-2051078689-24
%TEMP%\hsperfdata_user\3372
%ALLUSERSPROFILE%\jwrapper-remote access\logs\genericupdater-2026-09-06-22-04-36-199-pid0.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_interim
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\detectedproxies
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\proxycredentials
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\jwrapperusejre
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwrapperusejre
%ALLUSERSPROFILE%\jwrapper-remote access\remote accesswinlauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\remote_access_configureico.ico
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jwrapper-remote access-uninstallerico.ico
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\83aa4cc77f591dfc2374580bbd95f6ba_8cf7b530-613e-439b-a8c5-ccfc0e745400
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-windows64jre-00115399100-complete\bin\remote accesslauncher.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlaunchproperties-1788757479273-1
%TEMP%\hsperfdata_user\2712
%ALLUSERSPROFILE%\jwrapper-remote access\logs\remote access-jwrapperpostinstallapp-2026-09-06-22-04-41-369-pid2712.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jre-lastsuccessfuloptions-jwrapper-windows64jre-00115399100-complete
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\chosenlanguage
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlastrun
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-jwrapper-00115411574-complete\unrestricted\jwlastrun
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-windows64jre-00115399100-complete\unrestricted\jwlastrun
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlaunchproperties-1788757483079-2
%TEMP%\hsperfdata_user\2076
%ALLUSERSPROFILE%\jwrapper-remote access\logs\remote access-remote access configure-2026-09-06-22-04-46-328-pid2076.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml.afos_interim
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\remote access service.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\stopsimplegatewayservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\simplegateway.service
%ALLUSERSPROFILE%\jwrapper-remote access\logs\wrapper-2026-09-06-22-04-55-995.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\remote access configure.lnk
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-jwrapper-00115411574-complete\unrestricted\jwlaunchproperties-2051102859-24
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\uninstall remote access.lnk
%WINDIR%\temp\hsperfdata_fdjxvlf$\4672
%ALLUSERSPROFILE%\jwrapper-remote access\logs\genericupdater-2026-09-06-22-05-02-302-pid0.log
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\83aa4cc77f591dfc2374580bbd95f6ba_8cf7b530-613e-439b-a8c5-ccfc0e745400
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlaunchproperties-1788757504799-2
%ALLUSERSPROFILE%\jwrapper-remote access\logs\remote access-remote access service-2026-09-06-22-05-05-588-pid4672.log
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\version.txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\sgport
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceid.dat.afos_interim
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceid.dat

Deletes following files that it created itself

%TEMP%\ert_001f1c88\payload.zip
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\awu8vryp\jwrapper-windows64jre-version[1].txt
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-jwrapper-00115411574-complete\unrestricted\jwlaunchproperties-2051078689-24
%ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_complete
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlaunchproperties-1788757479273-1
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlaunchproperties-1788757483079-2
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml.afos_complete
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\simplegateway.service
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-jwrapper-00115411574-complete\unrestricted\jwlaunchproperties-2051102859-24
%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-remote access-00115411648-complete\unrestricted\jwlaunchproperties-1788757504799-2
%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceid.dat.afos_complete

Moves the following files

from %ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_interim to %ALLUSERSPROFILE%\jwrapper-remote access\jwapps\jrenameoverride.afos_complete
from %ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml.afos_interim to %ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceconfig.xml.afos_complete
from %ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceid.dat.afos_interim to %ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\serviceid.dat.afos_complete

Network activity

Connects to

'31.##.20.110':3847
'94.##6.179.30':80

TCP

HTTP GET requests

http://31.##.20.110:3847/dl/_dVfZ8Q90Obar52nlNxiWQ1pPCMpeRVL via 31.##.20.110

UDP

'94.##6.179.30':8040

Miscellaneous

Creates and executes the following

'%TEMP%\ert_001f1c88\x\built.exe'
'%LOCALAPPDATA%\autoelevator\runtime\built.exe'
'%LOCALAPPDATA%\autoelevator\runtime\.data\target.exe'
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrappertemp-1788757467-3-app\bin\windowslauncher.exe' "-Xshare:dump"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-windows64jre-00115399100-complete\bin\remote accesslauncher.exe' -cp "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\remoteaccess-jar-with-dependencies.jar;%ALLUSERSPROFILE%\JWra...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-windows64jre-00115399100-complete\bin\remote access.exe' -cp "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\remoteaccess-jar-with-dependencies.jar;%ALLUSERSPROFILE%\JWra...
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe' -uninstall "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe' -install "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe'
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\remote access service.exe'
'%ALLUSERSPROFILE%\jwrapper-remote access\jwrapper-remote access bundle-00115411648\jwrapper-windows64jre-00115399100-complete\bin\remote access.exe' "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dsun.java2d.dpiaware=true" "-Dsun.java2d...

Executes the following

'<SYSTEM32>\cmd.exe' /c if exist "%TEMP%\ert_001f1c88\x" rmdir /s /q "%TEMP%\ert_001f1c88\x"
'<SYSTEM32>\tar.exe' -xf "%TEMP%\ert_001f1c88\payload.zip" -C "%TEMP%\ert_001f1c88\x"
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /c /grant *S-1-5-32-545:(OI)(CI)RX
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access" /t /remove *S-1-1-0
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\JWrapper-Remote Access\JWApps" /t /c /grant *S-1-5-32-545:(OI)(CI)RX
'<SYSTEM32>\netsh.exe' advfirewall firewall show rule name=all
'%ALLUSERSPROFILE%\jwrapper-remote access\jwappssharedconfig\simplegatewayservice\remote access service.exe' ' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial