Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 15:42

General

  • Target

    20f5682f65f00f055506307ebfd1d303_JaffaCakes118.exe

  • Size

    9.4MB

  • MD5

    20f5682f65f00f055506307ebfd1d303

  • SHA1

    f5682ed3b3a6a82a0c47662c8d415b53821a79d7

  • SHA256

    a3650da7407ff30c64c0de626f71c0d2e39860bc84d888d8ccdec32f7c3713ac

  • SHA512

    dab2c1fc48c2d26fc01e14c4afb93d3f9b68547ff1ec9279f149e32e085867fe220510e56e557044d1fa75eb08cd6f13c5b1eed60a09a8415dd3d1d5253d78bb

  • SSDEEP

    196608:pi7n3Su5gTe3p2VLyM0/f7Pnj57ymavlb+zZhXWjTlh1RSa3yt:IbJmTe52VGM2/j57ym2b+zXWPlg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20f5682f65f00f055506307ebfd1d303_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\20f5682f65f00f055506307ebfd1d303_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\verpatch.exe.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\verpatch.exe"
      2⤵
      • Executes dropped EXE
      PID:4488
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2"
      2⤵
      • Executes dropped EXE
      PID:4496
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2"
      2⤵
      • Executes dropped EXE
      PID:4896
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar"
      2⤵
      • Executes dropped EXE
      PID:1504
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar"
      2⤵
      • Executes dropped EXE
      PID:5108
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar"
      2⤵
      • Executes dropped EXE
      PID:1544
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\javaw.exe" "-Xshare:dump"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4312
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lzma.exe" "d" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2.l2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2"
      2⤵
      • Executes dropped EXE
      PID:4292
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar"
      2⤵
      • Executes dropped EXE
      PID:4192
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar"
      2⤵
      • Executes dropped EXE
      PID:1300
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar"
      2⤵
      • Executes dropped EXE
      PID:2564
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar"
      2⤵
      • Executes dropped EXE
      PID:2820
    • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp Technician.exe
      "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp Technician.exe" "-cp" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\JWLaunchProperties-1715096569-0"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\verpatch.exe
        "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\verpatch.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp TechnicianUnavailable.exe" 4.0.0.0 /s description "SimpleHelp TechnicianUnavailable" /s ProductName "SimpleHelp TechnicianUnavailable" /pv 4.0.0.0 /s Company " " /s FullVersion " " /s LegalCopyright " "
        3⤵
        • Executes dropped EXE
        PID:5032
      • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp TechnicianUnavailable.exe
        "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\SimpleHelp TechnicianUnavailable.exe" -cp "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\technician.jar;C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\liquidlnf.jar;C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\jwrapper_utils.jar;" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true jwrapper.JWrapper "C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\JWLaunchProperties-1715096571529-39"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lib\jwstandalone.jar

    Filesize

    868KB

    MD5

    0d3d01681e4390dc0f2ce6c36fc088d0

    SHA1

    8715bc43f5b68915bff54b74764766fc53ffd36a

    SHA256

    4154c3d744f70e5c3a6924f1ec34c45fdd88c64dadc866298d205f852af44e81

    SHA512

    36acfcc794b99340eb4b94d456677cf187163d6593ba29b4b596e7d485dab4d4e92e6d24d73cf9e51d5da073f1e90e175d3327326724b4ebc2b1f8ee893161eb

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-JWrapper-00022776666-complete\lib\jwstandalonelaunch.jar

    Filesize

    5KB

    MD5

    1587ee22c1340a42cc56d80d5346974f

    SHA1

    e23b894db32dd2eb0b930af147e96ad1fd649816

    SHA256

    2c26798871752273f132f0d20641d48cd7b3fc10b03a6bbde43a79b5d54f9813

    SHA512

    fe7ba8fc49d50f271d3d05ab7a53de0a8e0cb39c7265eb62c2d807ef0bc5b6deea7131541dcdd8eb705077a2e69921e656e9c70dc0b4237ca97125a002bae041

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-SimpleHelp Technician-00022776762-complete\JWrapper-SimpleHelp Technician-splash.png

    Filesize

    8KB

    MD5

    08051133e368d61036576d3ed5b9cc14

    SHA1

    817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5

    SHA256

    5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7

    SHA512

    93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\bin\client\classes.jsa

    Filesize

    11.8MB

    MD5

    ec44ac26fdf248f04592ea7c3bdc9534

    SHA1

    fa3f3d0bbfb9c6ecbff2b8b0f4f672f875e3d96c

    SHA256

    839ca9fa5545fa9e931088dd6de305dfdfe5c1e2e7e540c4f213c36347f46bb9

    SHA512

    d09e8b11856b287e839629efdc3f8faa7b712f524c4392022e99265fd29db410d274897894acd2fb9e7b2dae1abc15f5a978d859ee4cba79812d9c461757b5bf

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\lib\ext\sunjce_provider.jar

    Filesize

    154KB

    MD5

    6cb444502fc6de0bd0dbb218e4194a09

    SHA1

    20a87531d8926714ca980d43c38ab8052dd2e422

    SHA256

    78ccb2e9f438c21cf6757b28b2d7f145f899faedddc9b75c6a7c9aefa9ed754b

    SHA512

    bfd2c2378899e1213c75b32139f5cc930a253cdea3042547f92fdddf0cd519b629e23a292da9ffd6f21b20a4b2e4bb90e7d1eab90364c655fb742f8c4ce4ca02

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapper-Windows64JRE-00018576699-complete\lib\security\java.security

    Filesize

    9KB

    MD5

    281ad86504781426545aa2d564d00854

    SHA1

    101a51d1a3f5a2eff68708b5a1b405c9b6e18ab4

    SHA256

    0f0b37de8fd8fe475fdf1b98aade684b3cd1936fb9532b2a737e82c0ba9cc24f

    SHA512

    bfb1e81eebaf26294b78b13904a27d7efb0c18e18ab0b57e020614a3f8ff2395d116caa700af0696a794fac198700af3876d539c8ce76dcbb50010e5e5c4be3b

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2

    Filesize

    1.2MB

    MD5

    d759570dace6ecf69db866c2d279d7b8

    SHA1

    69c79bf233473d24825a6aea2168c8c7db26b6c1

    SHA256

    4190a00547e79f5e53555d1eb408cee3856df85e491541395d1d9532d3b472aa

    SHA512

    c9a8a3f4da0f3d182c172c3f4940e27d3d6e4682a4a93788b7168039c04584341a5b571e868c600c27278dd02f7696f883f90d0d7d54ab580e9f97c7557f184b

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-JWrapper-00022776666-archive.p2.l2

    Filesize

    416KB

    MD5

    14ee15fd7ab5c9de865a19bc452fd1ec

    SHA1

    7ff6ad4a4f6f79ff6cff9d5801ab7734a45ebd40

    SHA256

    e497fba740d93a83840be3025cf384975b7f75d56119200cec3a165b167f6153

    SHA512

    f144b66b8723ee5b94e34e4e84ad647786ef664c6119116f12aacb4c95d4c4d482e7fb1c989b24dbd983d86a4a6fa0564430da11918d02177e2c547273309db5

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2

    Filesize

    8.0MB

    MD5

    a18392e45b008d52e3533e73399fb35f

    SHA1

    7260fabe83d1602647d989754744b43165585e02

    SHA256

    bfd1a497f058323b01764a39e9a99b41053abeb74bec07039a78d8fd4d262d56

    SHA512

    6abf60cd9da94b8391da7fbd3f11e0e3f88710ba254234e68f19e895f764604a19195cc8b6bd190a2fecbeaa944d18b79ebed41624c9db85be7633d96cd61b29

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\JWrapper-SimpleHelp Technician-00022776762-archive.p2.l2

    Filesize

    2.5MB

    MD5

    c473c2b5908049dbffccfa5534702d4e

    SHA1

    34e09b1d58a451af93164d40b143b42e2fbbc417

    SHA256

    ee0f99c952a92335b14f557bde9fe5cc0574d94aaf5f479e0ef699d24a815002

    SHA512

    ad5d77f18f2bbe6e2f45d20a62064eb897d6f5670f27ac9f991866becfe7261a52eca576a43e57e93110a70109eaccb615f27635419babd7a2a1390d0db17a4b

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar

    Filesize

    435KB

    MD5

    d0b3457413d9f3520aa2cf01bbdb844a

    SHA1

    cab8b4d8652d7fbe95bb7a43c48e73dfb47327f1

    SHA256

    d78dfff2624c5e0fb2b690d66485b02bd3ad8bc88a05be495537b12b0f35025c

    SHA512

    3ee81676d7e8e8e4c6320e3a69bd6bbb02371dd22d4b42242eefba5da04d6145d43145f6569525f7f5d0a44da7e4cec1c7499083f22a7fcf223da085aee72867

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\osxwrapper.jar.p2

    Filesize

    311KB

    MD5

    27606fc05e9fb908caee0c0f1c065d77

    SHA1

    710685d7b2b7c60ecafca9e20b82593d3968ccbc

    SHA256

    f3e78b6c246aa537b82ac60774f9d1137eea6c1b4a8d2b7b4426c7122acfeee2

    SHA512

    d616c397bc7438b004a0655338b33c440992b7941da8a5b54236477bb0367f14460fbfd1eae319eae21750efe5928fa9074bf9f194838d3aee78572862c9524c

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar

    Filesize

    86KB

    MD5

    7c709ee39955cdf793d0b7ed7023da78

    SHA1

    48e0d81c9786858d8bba55b73991f66d08b7c79d

    SHA256

    2278ab89ff2c5f3b6375f97155669e0cd8b4de49afa98c21529342af4cd97734

    SHA512

    3d7f0773498b15ecd598e8555b4552e189ab5f3171ba7e8fd07336055799e66bf6ed9af8fef3563794bb4b7cbb170836807a9da0dd8e90e2aba97d9909e8203c

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\SimpleHelp TechnicianMacLauncher.app\Contents\Resources\Java\sevenzip.jar.p2

    Filesize

    33KB

    MD5

    9c39bfc0eb4e7b8daeb2c80e738dced2

    SHA1

    28f453291b4cf838cf3ce28a056a96ffc4be49a8

    SHA256

    9cd97a5d1ee59e826a71e9e6d2246849a563786f0bda111a5c52f3a9d0fbc3e4

    SHA512

    67bd462999ac00a054c433d4cd7556f9e0880e564b4f479706ac540ebaf1a883018c4886caf3f543f0a630e9b79a1725806da721605b870dd79b638561172e79

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar

    Filesize

    998KB

    MD5

    b7a1f9bbc4c4ff412ade3a8e3c47a023

    SHA1

    0a7b1d3436f68818354a8bd06546035f26274dc2

    SHA256

    863c0126eb09c335fe628107d5e7a6aeadfd639174254b8b9810d67c20f282c2

    SHA512

    1f9ec729f3086fafa9111218aba0e1effd26306018ad958b7961dc9c5f95a614b0ea08a96de8a38a47805cd774e29538cab8b2c6f165e0eaa3ad38604bac96a9

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\jwrapper_utils.jar.p2

    Filesize

    376KB

    MD5

    f53ecc011509c1cfafc05362afefef22

    SHA1

    0845d4051c711c3f0465a3d61c692c1b655d7644

    SHA256

    48249ef429c938c65ca0b2efcdddbed6001984c7d4f2cf65c572ffd00b18a8d7

    SHA512

    b51d89d9c7df2662459df5a7d1ec4fca404295c63666a9418a98ef155ff4212ec99577b0d02f31e4c1cfdea71d3bc2943d833506647ae71ef3b783229adca4d8

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar

    Filesize

    308KB

    MD5

    4493e756bc5c08363172cf745707e52b

    SHA1

    178445f2dc6a709a73457c003735d63897f8f3f6

    SHA256

    f8e345a075f71d333650f4da54cd30140d0da69ab424c9c79cebd40080251692

    SHA512

    2bc58a91c690d181c64014aa5428e52c4eaa30d2b888975fbe7cf19f3228203cde0570419151bfcbf95ef3058ce7b37b3ebb46e80c3b052c1a8dc6fadd085ade

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\liquidlnf.jar.p2

    Filesize

    244KB

    MD5

    c602c315cf0a159b92a5f08fed2b8810

    SHA1

    463c17b2d0b5f59c13792f0c008777580036c9ee

    SHA256

    2a303d52186eb88bdce7580fe0e7fc8ca081ed7efeef590f9ccb2416cb72b33a

    SHA512

    b29c09fa59d615f68e2e4cd0c4fd07b210a00c020469e5e735a69d648336f995090d4d6648203289b244e7ea2df02b44060ba8fd88e53f6052d237d550ee6b3c

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\lzma.exe

    Filesize

    71KB

    MD5

    e59aa0e52e93c781dcdab8ad7cc4054c

    SHA1

    1be9c2d8b48d6e0c8a7cab6013cc36ea42ec421e

    SHA256

    410bfdaddee3767151296fe4f16052c39546151916f05bbe4ae1c6b698b18f0f

    SHA512

    d0be3580640bb2cca0c097ec2154132eeefd2b2b4b0e45027cc303c47a42f5c545d5f50182c70a69b5d1673112d24f8ae320d097d7034e810dbc0a5128b09050

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar

    Filesize

    7.4MB

    MD5

    45afa627d1d3eecca3285da1f37d2f7f

    SHA1

    c1f8dfd844eefa1a7d24b908a8d4d152855c862d

    SHA256

    3b4d02cdf96d85689eb66c2d42688b6fa6ff31ce3b14690f2aa3cb5589a2acbe

    SHA512

    f483ad59b4ed4fedf3cca3cd8a13249e42e628ef308d0f694ab7ff9a1202673eb150681cb19cce8848128a8b740a8e36780f51ee31805bdbd5f6564d611713b3

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\technician.jar.p2

    Filesize

    3.1MB

    MD5

    e7fc11044569263424710804c5248bed

    SHA1

    ccaf0f2e2788c3fa781b1d9f3128f0f3dafba1d8

    SHA256

    ac9f2e90c58d1cb748228cf7b19150461c64a8d5f9e8ca6e95b2368604c724ac

    SHA512

    021069eb4052168c56d3a76a228d070991b0c85c76af6de3bcbb19028e610f4f68cafbcc86f9601dc467266126f62712620875fdd1b1a67cedca80220a7be69f

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096562-0-app\verpatch.exe.l2

    Filesize

    64KB

    MD5

    a7d480c0e73710e1ba852992d639013c

    SHA1

    e5c28fe817cdc938357d4ffbbaf0a84b53a9a2f0

    SHA256

    bd08cd90152ea5b2bdfbaa4dfa4f34329293a3214a8f392b06aa76ea7549f38c

    SHA512

    a93afe8efa673a8897d88b2c213ff502e103f67feb9f2600b83190f8fb4bda86a09f80cabdf029b7c3481d3ef555fd72633279bf8c8813fc85748628159bbddb

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2

    Filesize

    17.0MB

    MD5

    c463dccc03afc8bf0ce9e541e03dba85

    SHA1

    2a13fa5c19c2aab571c7a011f837f25620df001a

    SHA256

    cc49e222af0b2ad862818ed3935a7c43e5b785392c88c604d9047d5a4cca12e8

    SHA512

    582d996083d79d14e29c84f32591f15a5ed6c364bdf4e7071246c81a6a4ce08fbd19686a071469083fd69a9334177afd9725ef76b6b976adfa1cd2fb82409b68

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\JWrapper-Windows64JRE-00018576699-archive.p2.l2

    Filesize

    6.0MB

    MD5

    a939e212256a5ee3864f8660f4dadf8d

    SHA1

    c0442ae26df16c4522e951ef3a881308887b36fc

    SHA256

    435f7d0e79d888e988cc760e368c7520b8f68f3be358f07a09cae959cca09c9d

    SHA512

    9255614014975e2f76fc5946d8b7b8b88bf7d10fa3722126294b733db0100c7e9a6f5e57d9754e2fd1a8fc561abb3b5fbb7e5b1c2d710dd498e463deefc1ad1f

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\client\jvm.dll

    Filesize

    1.6MB

    MD5

    c9c4c710990b34b3c851e76a56360fc9

    SHA1

    a1d7bbf2e6f198b2af725eb469b6d41d6ac979c1

    SHA256

    b6ed5d2218569e924930dd2a84536001ef34f89698b6c65140f05b1873266434

    SHA512

    d03f1827b5f3ad687a7f0664c537a8dfe090d97cce67f3d7970780777497b4fd1cbbfe893fbed1d3d4e39ed71a27b547c388685ea8d1c6fdbd673ecd87dad8b6

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\hpi.dll

    Filesize

    32KB

    MD5

    7f4f5d189ec48566d9d8c2ebaed68c74

    SHA1

    8ba4ab69b6a453640708ba8337e53d01ce041834

    SHA256

    ad9a3a3949742995b9b2b302e99b9a15a5c0211acccbdf4d6a9f86a69a3f305a

    SHA512

    52b461a23c4377974494a1b57f49e8c32e072e933be59f36900290f518504f7d42189e22aab7a51dcda128d0606bcd9c0a85404340313ac322e39db36828da13

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\java.dll

    Filesize

    116KB

    MD5

    3b3613ae9a31e5099ff803b8c858a86d

    SHA1

    5cc6c08550cd2f4ef6d37d521c7891051413f16d

    SHA256

    5a5e216f287cbcaf7a4ba8ccb8fcb3dae0b05378d89ba6a70f1d50b394306796

    SHA512

    ed360d73fcc2362129ff4e2c52f8fdf84970598f49be081740e7ed23d23fa8cdf7a01d13cbe2b8cff3fa0d2ecc7455487f98e827eabc2c0d76037e1d4afef365

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\javaw.exe

    Filesize

    52KB

    MD5

    141c0ddc4b7aa9287d1dea52c9525445

    SHA1

    b01e93615748020869be5f7dc73be6803ac18619

    SHA256

    9dee589ab11824cf051afbf5ba0d30e38a464571d23edb14f0ea9b6bdf9fc57c

    SHA512

    c5d7c14e11ea613b1c4b2a796254142136112b5682fccb1ebafbbc014601e5b103f8ab7a5d3a9d4b319a379741fb0bbffa6a214a142931e4f17aecdd54112a54

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\unpack200.exe

    Filesize

    124KB

    MD5

    0ac355d4114bcd53ad9aa4a01055c44f

    SHA1

    3a7c3c936a73de1c414b08391b37fe9c106990da

    SHA256

    80b00b9c76c491322779d0c2ef3fb0bb6d9609b7a73eb85e1bb08ebb76c049aa

    SHA512

    f18886f522c226e379166a7dd9cae600f000b696aa31ac9c7e54e76b7a74de226127637eb7cd8de3bb454883a0b82cb1b6236f8180296e6dc42d8a228e6933b4

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\verify.dll

    Filesize

    48KB

    MD5

    95c10f3184ed7aa45709f7cd70b49589

    SHA1

    1096dc0c79d201b7bd77e0399c6b8d86bc1f8a6f

    SHA256

    e6f4b6e25a2bc7fc03a73032c60138410b30ac528c7d10da87ea612e52a7b736

    SHA512

    211c522ccdeee5145cf1cddc9806c79915d16ac1d2614c3bcf75d776d61c314c66ebef53f90aae5218ad472c15fba12f0ad0d19f0dfbb022fd36462e480de637

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\bin\zip.dll

    Filesize

    60KB

    MD5

    19984073548bc33fc67c04aa277cdd44

    SHA1

    64189f2f71e40ae2794dcfb2df53056a82aa33c2

    SHA256

    f450c1a55a143d35b8b330c7538c22b8781d729aa947e27cbc2afc4e19434686

    SHA512

    b08ac43a0c6f12301339c30717908989ffe8bc3cf3889bcd347e83dbdc6fb21150d715da8525edd800015122c417da0870d08affbf35b5496410e36b913c5022

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\classlist

    Filesize

    76KB

    MD5

    ef2f77d23cd37746737f2f34f953b27c

    SHA1

    d3fc136fcf5421f31bf379a57f55fdb76450461d

    SHA256

    c5f11846410444f7eba84742a71d0693f4e25439af58e1ce7db41e21b7806e77

    SHA512

    66a1729bddc5a8dc8bc47c00c9a59f1d99f282c42dc177d58f11d283437209764e795168aaac03b2c00aff013d1329163faa6406cca8b08cfb6a8679a57e4bb5

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar

    Filesize

    166KB

    MD5

    25edf09d6b9a5fd1fecce20e16cd955c

    SHA1

    425cb995e9fbe57ee915ffd53a2457cde46f496d

    SHA256

    0cd8fdfbab6d535c5caec7f70d5dd425d6a7ef6bf953b44e81db7220b8cfcffd

    SHA512

    02b1f9a4e76257d913ce4280e28c3ef6677e118e329b08cd60c34f28dd57ee99f7a85ec0879ee0cdab36926447dd81771b7c142882fb650d5ed5a5cc407f2f3d

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\ext\sunpkcs11.jar.p2

    Filesize

    120KB

    MD5

    1e3aae27c091733c0df95b1762ed5a92

    SHA1

    d8d865d9c26ff76651cd81d2e253d50a67ff6718

    SHA256

    dec4fac179d022add2f72f08286ea74687180e3b26f1c79e2c54aa3e815f4636

    SHA512

    123d55ceb49d93312af5b28e04b9ba6ce24e635e230ca0e6798ab3048f883c58f03c4236d675a56e3163b06825063bd5a0affca35b620e69ba23db5a2c27ac6d

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\i386\jvm.cfg

    Filesize

    695B

    MD5

    8d52e756ca8cbe07741e1640b38a0f87

    SHA1

    bde0eca45c0d1b0be7250245eaa55487384c8bd3

    SHA256

    db32e24f9ab72c2a30e2cd2f80300b3640b8f04d2cf7dcd86fb15261ba46983c

    SHA512

    f1faa89f350da7d656d80aa8642e773af4cc5481719b627f3b2d313b03845a78b4700c77e25583e4157fda599745e2f4a06dd71adfb64d7294bfb9ef6e2865c6

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jce.jar

    Filesize

    80KB

    MD5

    8bfb4f2b5a7db5c2f66029cebcda61af

    SHA1

    544317c36b07e20b091ed1c276a1fba20719a696

    SHA256

    8c18142a4f95801050b8bddb632fa46b6c77f8937733b1b352ae71fde0d5f0ea

    SHA512

    06fc3734cfd6778b1f389fb111079ffd959798cfffcf799c563f228c70280373f7e412d2258f0abeeffe0979b3a4295ed123c0992e9fe724c5e6505e14db096b

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar

    Filesize

    474KB

    MD5

    3902fa042a832f116c4bbdb8ac260396

    SHA1

    bbf56369190cd403dffc6114121bc93ef1f8bd94

    SHA256

    87d8858ed9ba36a65a71410816d041f878d61732be37c00a5521596d5d729b4d

    SHA512

    f79c93b40d109525d65b008d495751aa85ca9b43e32697028979da597c9ea5d265fd7b23b4979d1e874555768e375e56ada9cdafce776a2acfcb934e94be9706

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\jsse.jar.p2

    Filesize

    115KB

    MD5

    41789f3bfea0465b6b5dfdbe133fe342

    SHA1

    0061d61370170afdc3984d2e0016c5b8d10b3946

    SHA256

    3f1931393c34b8828c37668bb34891cabce89a4caad9d2a1e8ad07b0c2f205c6

    SHA512

    2f6f8d579d9806d8b8a6c2e582e065a889c02347f8141e79c02ba238d100a11e2a491f1f915fc95bb297b0be498a2e3c2267bc78d10b9578c40c11f53f166735

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar

    Filesize

    32.6MB

    MD5

    7dadc17907c9e2aeb4dc7a9faccfceec

    SHA1

    19ff33fb9bd10a53b201c2ea6c4e537838534880

    SHA256

    1ea594712c7e982dc297e0da402473a8f9c0ed75bdb357594c7eab4857d568e1

    SHA512

    14311a2fa97cf9b623ab9aaffbecd06aecf584d6b7312eef6b3b125d7e42e4eebe79a7b906903306a05c9ba9f6d0facf0ce94bcd69928f123989cf0ad7291037

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\rt.jar.p2

    Filesize

    8.8MB

    MD5

    28b0cedfa214a6db37e63dedd60fe70b

    SHA1

    f6ef31e6bab599eb0d83d4e7cb9cd906dda56137

    SHA256

    69e611fffa7d26b950a2b53899f938730fa29ad0f30800260f62fa31c048097d

    SHA512

    f5b0c967af2e324847da01c6c373ed13558988edea4d36f7167b744e3648e208c9b959cc24626c9d9b05cd8a37e8035d3ce01f27bba13903ddf56a94701f8b29

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\JWrapperTemp-1715096563-0-app\lib\zi\GMT

    Filesize

    27B

    MD5

    7da9aa0de33b521b3399a4ffd4078bdb

    SHA1

    f188a712f77103d544d4acf91d13dbc664c67034

    SHA256

    0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d

    SHA512

    9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6

  • C:\Users\Admin\AppData\Roaming\JWrapper-SimpleHelp Technician\SimpleHelp TechnicianWinLauncher.exe

    Filesize

    403KB

    MD5

    6397711b659ff13361d95fda106b40ad

    SHA1

    07119bfe7fc9642f57b61453dfb50459b57d07fb

    SHA256

    5b44f8be677052783349046a4f210114f64a8ab9e26efe0f84b9b3ba1bf90ffa

    SHA512

    3df7533f899b4cc2159ac73cb3a1e885ce81868ad812e55b2a2abf85e77a044afa050c8f2267c672f3a488fdfc7d6c3415c2e9981f86064aaabbb4572ecdaa2b

  • memory/3664-698-0x000000002D860000-0x000000002D870000-memory.dmp

    Filesize

    64KB

  • memory/4312-605-0x0000000002060000-0x0000000002090000-memory.dmp

    Filesize

    192KB