Analysis

  • max time kernel
    137s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 15:42

General

  • Target

    20f5682f65f00f055506307ebfd1d303_JaffaCakes118.exe

  • Size

    9.4MB

  • MD5

    20f5682f65f00f055506307ebfd1d303

  • SHA1

    f5682ed3b3a6a82a0c47662c8d415b53821a79d7

  • SHA256

    a3650da7407ff30c64c0de626f71c0d2e39860bc84d888d8ccdec32f7c3713ac

  • SHA512

    dab2c1fc48c2d26fc01e14c4afb93d3f9b68547ff1ec9279f149e32e085867fe220510e56e557044d1fa75eb08cd6f13c5b1eed60a09a8415dd3d1d5253d78bb

  • SSDEEP

    196608:pi7n3Su5gTe3p2VLyM0/f7Pnj57ymavlb+zZhXWjTlh1RSa3yt:IbJmTe52VGM2/j57ym2b+zXWPlg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20f5682f65f00f055506307ebfd1d303_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\20f5682f65f00f055506307ebfd1d303_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\verpatch.exe.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\verpatch.exe"
      2⤵
      • Executes dropped EXE
      PID:4488
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2"
      2⤵
      • Executes dropped EXE
      PID:4496
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2"
      2⤵
      • Executes dropped EXE
      PID:4896
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar"
      2⤵
      • Executes dropped EXE
      PID:1504
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar"
      2⤵
      • Executes dropped EXE
      PID:5108
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar"
      2⤵
      • Executes dropped EXE
      PID:1544
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\javaw.exe" "-Xshare:dump"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4312
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2"
      2⤵
      • Executes dropped EXE
      PID:4292
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar"
      2⤵
      • Executes dropped EXE
      PID:4192
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar"
      2⤵
      • Executes dropped EXE
      PID:1300
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar"
      2⤵
      • Executes dropped EXE
      PID:2564
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar"
      2⤵
      • Executes dropped EXE
      PID:2820
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp Technician.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp Technician.exe" "-cp" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\JWLaunchProperties-1715096569-0"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\verpatch.exe
        "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\verpatch.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp TechnicianUnavailable.exe" 4.0.0.0 /s description "SimpleHelp TechnicianUnavailable" /s ProductName "SimpleHelp TechnicianUnavailable" /pv 4.0.0.0 /s Company " " /s FullVersion " " /s LegalCopyright " "
        3⤵
        • Executes dropped EXE
        PID:5032
      • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp TechnicianUnavailable.exe
        "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp TechnicianUnavailable.exe" -cp "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\technician.jar;C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\liquidlnf.jar;C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\jwrapper_utils.jar;" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true jwrapper.JWrapper "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\JWLaunchProperties-1715096571529-39"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2284

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lib\jwstandalone.jar

          Filesize

          868KB

          MD5

          0d3d01681e4390dc0f2ce6c36fc088d0

          SHA1

          8715bc43f5b68915bff54b74764766fc53ffd36a

          SHA256

          4154c3d744f70e5c3a6924f1ec34c45fdd88c64dadc866298d205f852af44e81

          SHA512

          36acfcc794b99340eb4b94d456677cf187163d6593ba29b4b596e7d485dab4d4e92e6d24d73cf9e51d5da073f1e90e175d3327326724b4ebc2b1f8ee893161eb

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lib\jwstandalonelaunch.jar

          Filesize

          5KB

          MD5

          1587ee22c1340a42cc56d80d5346974f

          SHA1

          e23b894db32dd2eb0b930af147e96ad1fd649816

          SHA256

          2c26798871752273f132f0d20641d48cd7b3fc10b03a6bbde43a79b5d54f9813

          SHA512

          fe7ba8fc49d50f271d3d05ab7a53de0a8e0cb39c7265eb62c2d807ef0bc5b6deea7131541dcdd8eb705077a2e69921e656e9c70dc0b4237ca97125a002bae041

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\JWrapper-SimpleHelp Technician-splash.png

          Filesize

          8KB

          MD5

          08051133e368d61036576d3ed5b9cc14

          SHA1

          817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5

          SHA256

          5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7

          SHA512

          93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\client\classes.jsa

          Filesize

          11.8MB

          MD5

          ec44ac26fdf248f04592ea7c3bdc9534

          SHA1

          fa3f3d0bbfb9c6ecbff2b8b0f4f672f875e3d96c

          SHA256

          839ca9fa5545fa9e931088dd6de305dfdfe5c1e2e7e540c4f213c36347f46bb9

          SHA512

          d09e8b11856b287e839629efdc3f8faa7b712f524c4392022e99265fd29db410d274897894acd2fb9e7b2dae1abc15f5a978d859ee4cba79812d9c461757b5bf

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\lib\ext\sunjce_provider.jar

          Filesize

          154KB

          MD5

          6cb444502fc6de0bd0dbb218e4194a09

          SHA1

          20a87531d8926714ca980d43c38ab8052dd2e422

          SHA256

          78ccb2e9f438c21cf6757b28b2d7f145f899faedddc9b75c6a7c9aefa9ed754b

          SHA512

          bfd2c2378899e1213c75b32139f5cc930a253cdea3042547f92fdddf0cd519b629e23a292da9ffd6f21b20a4b2e4bb90e7d1eab90364c655fb742f8c4ce4ca02

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\lib\security\java.security

          Filesize

          9KB

          MD5

          281ad86504781426545aa2d564d00854

          SHA1

          101a51d1a3f5a2eff68708b5a1b405c9b6e18ab4

          SHA256

          0f0b37de8fd8fe475fdf1b98aade684b3cd1936fb9532b2a737e82c0ba9cc24f

          SHA512

          bfb1e81eebaf26294b78b13904a27d7efb0c18e18ab0b57e020614a3f8ff2395d116caa700af0696a794fac198700af3876d539c8ce76dcbb50010e5e5c4be3b

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2

          Filesize

          1.2MB

          MD5

          d759570dace6ecf69db866c2d279d7b8

          SHA1

          69c79bf233473d24825a6aea2168c8c7db26b6c1

          SHA256

          4190a00547e79f5e53555d1eb408cee3856df85e491541395d1d9532d3b472aa

          SHA512

          c9a8a3f4da0f3d182c172c3f4940e27d3d6e4682a4a93788b7168039c04584341a5b571e868c600c27278dd02f7696f883f90d0d7d54ab580e9f97c7557f184b

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2.l2

          Filesize

          416KB

          MD5

          14ee15fd7ab5c9de865a19bc452fd1ec

          SHA1

          7ff6ad4a4f6f79ff6cff9d5801ab7734a45ebd40

          SHA256

          e497fba740d93a83840be3025cf384975b7f75d56119200cec3a165b167f6153

          SHA512

          f144b66b8723ee5b94e34e4e84ad647786ef664c6119116f12aacb4c95d4c4d482e7fb1c989b24dbd983d86a4a6fa0564430da11918d02177e2c547273309db5

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2

          Filesize

          8.0MB

          MD5

          a18392e45b008d52e3533e73399fb35f

          SHA1

          7260fabe83d1602647d989754744b43165585e02

          SHA256

          bfd1a497f058323b01764a39e9a99b41053abeb74bec07039a78d8fd4d262d56

          SHA512

          6abf60cd9da94b8391da7fbd3f11e0e3f88710ba254234e68f19e895f764604a19195cc8b6bd190a2fecbeaa944d18b79ebed41624c9db85be7633d96cd61b29

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2.l2

          Filesize

          2.5MB

          MD5

          c473c2b5908049dbffccfa5534702d4e

          SHA1

          34e09b1d58a451af93164d40b143b42e2fbbc417

          SHA256

          ee0f99c952a92335b14f557bde9fe5cc0574d94aaf5f479e0ef699d24a815002

          SHA512

          ad5d77f18f2bbe6e2f45d20a62064eb897d6f5670f27ac9f991866becfe7261a52eca576a43e57e93110a70109eaccb615f27635419babd7a2a1390d0db17a4b

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar

          Filesize

          435KB

          MD5

          d0b3457413d9f3520aa2cf01bbdb844a

          SHA1

          cab8b4d8652d7fbe95bb7a43c48e73dfb47327f1

          SHA256

          d78dfff2624c5e0fb2b690d66485b02bd3ad8bc88a05be495537b12b0f35025c

          SHA512

          3ee81676d7e8e8e4c6320e3a69bd6bbb02371dd22d4b42242eefba5da04d6145d43145f6569525f7f5d0a44da7e4cec1c7499083f22a7fcf223da085aee72867

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar.p2

          Filesize

          311KB

          MD5

          27606fc05e9fb908caee0c0f1c065d77

          SHA1

          710685d7b2b7c60ecafca9e20b82593d3968ccbc

          SHA256

          f3e78b6c246aa537b82ac60774f9d1137eea6c1b4a8d2b7b4426c7122acfeee2

          SHA512

          d616c397bc7438b004a0655338b33c440992b7941da8a5b54236477bb0367f14460fbfd1eae319eae21750efe5928fa9074bf9f194838d3aee78572862c9524c

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar

          Filesize

          86KB

          MD5

          7c709ee39955cdf793d0b7ed7023da78

          SHA1

          48e0d81c9786858d8bba55b73991f66d08b7c79d

          SHA256

          2278ab89ff2c5f3b6375f97155669e0cd8b4de49afa98c21529342af4cd97734

          SHA512

          3d7f0773498b15ecd598e8555b4552e189ab5f3171ba7e8fd07336055799e66bf6ed9af8fef3563794bb4b7cbb170836807a9da0dd8e90e2aba97d9909e8203c

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar.p2

          Filesize

          33KB

          MD5

          9c39bfc0eb4e7b8daeb2c80e738dced2

          SHA1

          28f453291b4cf838cf3ce28a056a96ffc4be49a8

          SHA256

          9cd97a5d1ee59e826a71e9e6d2246849a563786f0bda111a5c52f3a9d0fbc3e4

          SHA512

          67bd462999ac00a054c433d4cd7556f9e0880e564b4f479706ac540ebaf1a883018c4886caf3f543f0a630e9b79a1725806da721605b870dd79b638561172e79

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar

          Filesize

          998KB

          MD5

          b7a1f9bbc4c4ff412ade3a8e3c47a023

          SHA1

          0a7b1d3436f68818354a8bd06546035f26274dc2

          SHA256

          863c0126eb09c335fe628107d5e7a6aeadfd639174254b8b9810d67c20f282c2

          SHA512

          1f9ec729f3086fafa9111218aba0e1effd26306018ad958b7961dc9c5f95a614b0ea08a96de8a38a47805cd774e29538cab8b2c6f165e0eaa3ad38604bac96a9

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar.p2

          Filesize

          376KB

          MD5

          f53ecc011509c1cfafc05362afefef22

          SHA1

          0845d4051c711c3f0465a3d61c692c1b655d7644

          SHA256

          48249ef429c938c65ca0b2efcdddbed6001984c7d4f2cf65c572ffd00b18a8d7

          SHA512

          b51d89d9c7df2662459df5a7d1ec4fca404295c63666a9418a98ef155ff4212ec99577b0d02f31e4c1cfdea71d3bc2943d833506647ae71ef3b783229adca4d8

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar

          Filesize

          308KB

          MD5

          4493e756bc5c08363172cf745707e52b

          SHA1

          178445f2dc6a709a73457c003735d63897f8f3f6

          SHA256

          f8e345a075f71d333650f4da54cd30140d0da69ab424c9c79cebd40080251692

          SHA512

          2bc58a91c690d181c64014aa5428e52c4eaa30d2b888975fbe7cf19f3228203cde0570419151bfcbf95ef3058ce7b37b3ebb46e80c3b052c1a8dc6fadd085ade

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar.p2

          Filesize

          244KB

          MD5

          c602c315cf0a159b92a5f08fed2b8810

          SHA1

          463c17b2d0b5f59c13792f0c008777580036c9ee

          SHA256

          2a303d52186eb88bdce7580fe0e7fc8ca081ed7efeef590f9ccb2416cb72b33a

          SHA512

          b29c09fa59d615f68e2e4cd0c4fd07b210a00c020469e5e735a69d648336f995090d4d6648203289b244e7ea2df02b44060ba8fd88e53f6052d237d550ee6b3c

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe

          Filesize

          71KB

          MD5

          e59aa0e52e93c781dcdab8ad7cc4054c

          SHA1

          1be9c2d8b48d6e0c8a7cab6013cc36ea42ec421e

          SHA256

          410bfdaddee3767151296fe4f16052c39546151916f05bbe4ae1c6b698b18f0f

          SHA512

          d0be3580640bb2cca0c097ec2154132eeefd2b2b4b0e45027cc303c47a42f5c545d5f50182c70a69b5d1673112d24f8ae320d097d7034e810dbc0a5128b09050

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar

          Filesize

          7.4MB

          MD5

          45afa627d1d3eecca3285da1f37d2f7f

          SHA1

          c1f8dfd844eefa1a7d24b908a8d4d152855c862d

          SHA256

          3b4d02cdf96d85689eb66c2d42688b6fa6ff31ce3b14690f2aa3cb5589a2acbe

          SHA512

          f483ad59b4ed4fedf3cca3cd8a13249e42e628ef308d0f694ab7ff9a1202673eb150681cb19cce8848128a8b740a8e36780f51ee31805bdbd5f6564d611713b3

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar.p2

          Filesize

          3.1MB

          MD5

          e7fc11044569263424710804c5248bed

          SHA1

          ccaf0f2e2788c3fa781b1d9f3128f0f3dafba1d8

          SHA256

          ac9f2e90c58d1cb748228cf7b19150461c64a8d5f9e8ca6e95b2368604c724ac

          SHA512

          021069eb4052168c56d3a76a228d070991b0c85c76af6de3bcbb19028e610f4f68cafbcc86f9601dc467266126f62712620875fdd1b1a67cedca80220a7be69f

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\verpatch.exe.l2

          Filesize

          64KB

          MD5

          a7d480c0e73710e1ba852992d639013c

          SHA1

          e5c28fe817cdc938357d4ffbbaf0a84b53a9a2f0

          SHA256

          bd08cd90152ea5b2bdfbaa4dfa4f34329293a3214a8f392b06aa76ea7549f38c

          SHA512

          a93afe8efa673a8897d88b2c213ff502e103f67feb9f2600b83190f8fb4bda86a09f80cabdf029b7c3481d3ef555fd72633279bf8c8813fc85748628159bbddb

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2

          Filesize

          17.0MB

          MD5

          c463dccc03afc8bf0ce9e541e03dba85

          SHA1

          2a13fa5c19c2aab571c7a011f837f25620df001a

          SHA256

          cc49e222af0b2ad862818ed3935a7c43e5b785392c88c604d9047d5a4cca12e8

          SHA512

          582d996083d79d14e29c84f32591f15a5ed6c364bdf4e7071246c81a6a4ce08fbd19686a071469083fd69a9334177afd9725ef76b6b976adfa1cd2fb82409b68

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2.l2

          Filesize

          6.0MB

          MD5

          a939e212256a5ee3864f8660f4dadf8d

          SHA1

          c0442ae26df16c4522e951ef3a881308887b36fc

          SHA256

          435f7d0e79d888e988cc760e368c7520b8f68f3be358f07a09cae959cca09c9d

          SHA512

          9255614014975e2f76fc5946d8b7b8b88bf7d10fa3722126294b733db0100c7e9a6f5e57d9754e2fd1a8fc561abb3b5fbb7e5b1c2d710dd498e463deefc1ad1f

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\client\jvm.dll

          Filesize

          1.6MB

          MD5

          c9c4c710990b34b3c851e76a56360fc9

          SHA1

          a1d7bbf2e6f198b2af725eb469b6d41d6ac979c1

          SHA256

          b6ed5d2218569e924930dd2a84536001ef34f89698b6c65140f05b1873266434

          SHA512

          d03f1827b5f3ad687a7f0664c537a8dfe090d97cce67f3d7970780777497b4fd1cbbfe893fbed1d3d4e39ed71a27b547c388685ea8d1c6fdbd673ecd87dad8b6

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\hpi.dll

          Filesize

          32KB

          MD5

          7f4f5d189ec48566d9d8c2ebaed68c74

          SHA1

          8ba4ab69b6a453640708ba8337e53d01ce041834

          SHA256

          ad9a3a3949742995b9b2b302e99b9a15a5c0211acccbdf4d6a9f86a69a3f305a

          SHA512

          52b461a23c4377974494a1b57f49e8c32e072e933be59f36900290f518504f7d42189e22aab7a51dcda128d0606bcd9c0a85404340313ac322e39db36828da13

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\java.dll

          Filesize

          116KB

          MD5

          3b3613ae9a31e5099ff803b8c858a86d

          SHA1

          5cc6c08550cd2f4ef6d37d521c7891051413f16d

          SHA256

          5a5e216f287cbcaf7a4ba8ccb8fcb3dae0b05378d89ba6a70f1d50b394306796

          SHA512

          ed360d73fcc2362129ff4e2c52f8fdf84970598f49be081740e7ed23d23fa8cdf7a01d13cbe2b8cff3fa0d2ecc7455487f98e827eabc2c0d76037e1d4afef365

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\javaw.exe

          Filesize

          52KB

          MD5

          141c0ddc4b7aa9287d1dea52c9525445

          SHA1

          b01e93615748020869be5f7dc73be6803ac18619

          SHA256

          9dee589ab11824cf051afbf5ba0d30e38a464571d23edb14f0ea9b6bdf9fc57c

          SHA512

          c5d7c14e11ea613b1c4b2a796254142136112b5682fccb1ebafbbc014601e5b103f8ab7a5d3a9d4b319a379741fb0bbffa6a214a142931e4f17aecdd54112a54

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe

          Filesize

          124KB

          MD5

          0ac355d4114bcd53ad9aa4a01055c44f

          SHA1

          3a7c3c936a73de1c414b08391b37fe9c106990da

          SHA256

          80b00b9c76c491322779d0c2ef3fb0bb6d9609b7a73eb85e1bb08ebb76c049aa

          SHA512

          f18886f522c226e379166a7dd9cae600f000b696aa31ac9c7e54e76b7a74de226127637eb7cd8de3bb454883a0b82cb1b6236f8180296e6dc42d8a228e6933b4

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\verify.dll

          Filesize

          48KB

          MD5

          95c10f3184ed7aa45709f7cd70b49589

          SHA1

          1096dc0c79d201b7bd77e0399c6b8d86bc1f8a6f

          SHA256

          e6f4b6e25a2bc7fc03a73032c60138410b30ac528c7d10da87ea612e52a7b736

          SHA512

          211c522ccdeee5145cf1cddc9806c79915d16ac1d2614c3bcf75d776d61c314c66ebef53f90aae5218ad472c15fba12f0ad0d19f0dfbb022fd36462e480de637

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\zip.dll

          Filesize

          60KB

          MD5

          19984073548bc33fc67c04aa277cdd44

          SHA1

          64189f2f71e40ae2794dcfb2df53056a82aa33c2

          SHA256

          f450c1a55a143d35b8b330c7538c22b8781d729aa947e27cbc2afc4e19434686

          SHA512

          b08ac43a0c6f12301339c30717908989ffe8bc3cf3889bcd347e83dbdc6fb21150d715da8525edd800015122c417da0870d08affbf35b5496410e36b913c5022

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\classlist

          Filesize

          76KB

          MD5

          ef2f77d23cd37746737f2f34f953b27c

          SHA1

          d3fc136fcf5421f31bf379a57f55fdb76450461d

          SHA256

          c5f11846410444f7eba84742a71d0693f4e25439af58e1ce7db41e21b7806e77

          SHA512

          66a1729bddc5a8dc8bc47c00c9a59f1d99f282c42dc177d58f11d283437209764e795168aaac03b2c00aff013d1329163faa6406cca8b08cfb6a8679a57e4bb5

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar

          Filesize

          166KB

          MD5

          25edf09d6b9a5fd1fecce20e16cd955c

          SHA1

          425cb995e9fbe57ee915ffd53a2457cde46f496d

          SHA256

          0cd8fdfbab6d535c5caec7f70d5dd425d6a7ef6bf953b44e81db7220b8cfcffd

          SHA512

          02b1f9a4e76257d913ce4280e28c3ef6677e118e329b08cd60c34f28dd57ee99f7a85ec0879ee0cdab36926447dd81771b7c142882fb650d5ed5a5cc407f2f3d

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar.p2

          Filesize

          120KB

          MD5

          1e3aae27c091733c0df95b1762ed5a92

          SHA1

          d8d865d9c26ff76651cd81d2e253d50a67ff6718

          SHA256

          dec4fac179d022add2f72f08286ea74687180e3b26f1c79e2c54aa3e815f4636

          SHA512

          123d55ceb49d93312af5b28e04b9ba6ce24e635e230ca0e6798ab3048f883c58f03c4236d675a56e3163b06825063bd5a0affca35b620e69ba23db5a2c27ac6d

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\i386\jvm.cfg

          Filesize

          695B

          MD5

          8d52e756ca8cbe07741e1640b38a0f87

          SHA1

          bde0eca45c0d1b0be7250245eaa55487384c8bd3

          SHA256

          db32e24f9ab72c2a30e2cd2f80300b3640b8f04d2cf7dcd86fb15261ba46983c

          SHA512

          f1faa89f350da7d656d80aa8642e773af4cc5481719b627f3b2d313b03845a78b4700c77e25583e4157fda599745e2f4a06dd71adfb64d7294bfb9ef6e2865c6

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jce.jar

          Filesize

          80KB

          MD5

          8bfb4f2b5a7db5c2f66029cebcda61af

          SHA1

          544317c36b07e20b091ed1c276a1fba20719a696

          SHA256

          8c18142a4f95801050b8bddb632fa46b6c77f8937733b1b352ae71fde0d5f0ea

          SHA512

          06fc3734cfd6778b1f389fb111079ffd959798cfffcf799c563f228c70280373f7e412d2258f0abeeffe0979b3a4295ed123c0992e9fe724c5e6505e14db096b

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar

          Filesize

          474KB

          MD5

          3902fa042a832f116c4bbdb8ac260396

          SHA1

          bbf56369190cd403dffc6114121bc93ef1f8bd94

          SHA256

          87d8858ed9ba36a65a71410816d041f878d61732be37c00a5521596d5d729b4d

          SHA512

          f79c93b40d109525d65b008d495751aa85ca9b43e32697028979da597c9ea5d265fd7b23b4979d1e874555768e375e56ada9cdafce776a2acfcb934e94be9706

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar.p2

          Filesize

          115KB

          MD5

          41789f3bfea0465b6b5dfdbe133fe342

          SHA1

          0061d61370170afdc3984d2e0016c5b8d10b3946

          SHA256

          3f1931393c34b8828c37668bb34891cabce89a4caad9d2a1e8ad07b0c2f205c6

          SHA512

          2f6f8d579d9806d8b8a6c2e582e065a889c02347f8141e79c02ba238d100a11e2a491f1f915fc95bb297b0be498a2e3c2267bc78d10b9578c40c11f53f166735

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar

          Filesize

          32.6MB

          MD5

          7dadc17907c9e2aeb4dc7a9faccfceec

          SHA1

          19ff33fb9bd10a53b201c2ea6c4e537838534880

          SHA256

          1ea594712c7e982dc297e0da402473a8f9c0ed75bdb357594c7eab4857d568e1

          SHA512

          14311a2fa97cf9b623ab9aaffbecd06aecf584d6b7312eef6b3b125d7e42e4eebe79a7b906903306a05c9ba9f6d0facf0ce94bcd69928f123989cf0ad7291037

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar.p2

          Filesize

          8.8MB

          MD5

          28b0cedfa214a6db37e63dedd60fe70b

          SHA1

          f6ef31e6bab599eb0d83d4e7cb9cd906dda56137

          SHA256

          69e611fffa7d26b950a2b53899f938730fa29ad0f30800260f62fa31c048097d

          SHA512

          f5b0c967af2e324847da01c6c373ed13558988edea4d36f7167b744e3648e208c9b959cc24626c9d9b05cd8a37e8035d3ce01f27bba13903ddf56a94701f8b29

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\zi\GMT

          Filesize

          27B

          MD5

          7da9aa0de33b521b3399a4ffd4078bdb

          SHA1

          f188a712f77103d544d4acf91d13dbc664c67034

          SHA256

          0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d

          SHA512

          9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6

        • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\SimpleHelp TechnicianWinLauncher.exe

          Filesize

          403KB

          MD5

          6397711b659ff13361d95fda106b40ad

          SHA1

          07119bfe7fc9642f57b61453dfb50459b57d07fb

          SHA256

          5b44f8be677052783349046a4f210114f64a8ab9e26efe0f84b9b3ba1bf90ffa

          SHA512

          3df7533f899b4cc2159ac73cb3a1e885ce81868ad812e55b2a2abf85e77a044afa050c8f2267c672f3a488fdfc7d6c3415c2e9981f86064aaabbb4572ecdaa2b

        • memory/3664-698-0x000000002D860000-0x000000002D870000-memory.dmp

          Filesize

          64KB

        • memory/4312-605-0x0000000002060000-0x0000000002090000-memory.dmp

          Filesize

          192KB