Windows Analysis Report
wrapper-windows-x86-64-3.5.59-pro.exe

Overview

General Information

Sample name: wrapper-windows-x86-64-3.5.59-pro.exe
Analysis ID: 1532860
MD5: 4cb008375a7b737c1a6ccf569327df9e
SHA1: 67eb89f50b067628ad733ba3b1a47cdd42dd0364
SHA256: 4c65e4b6f9909d4d4bfc74852c33fd05de53a952d98968bd94d323ec14573992
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 40%

Compliance

Score: 34
Range: 0 - 100

Signatures

Creates a process in suspended mode (likely to inject code)
Drops PE files
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe EXE: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapper.exe Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe EXE: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapperw.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe EXE: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapper.exe Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe EXE: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapperw.exe Jump to behavior
Uses 32bit PE files
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Windows\SysWOW64\notepad.exe Window detected: -------------------------------------------------------------------------------Java Service Wrapper Professional Edition 3.5.59Copyright (C) 1999-2024 Tanuki Software Ltd. All Rights Reserved.https://wrapper.tanukisoftware.com-------------------------------------------------------------------------------Summary:1. What is the Java Service Wrapper?2. Documentation3. Installation4. License Options5. How to Purchase6. Getting Updates7. FAQ8. Support9. System Requirements1. What is the Java Service Wrapper?-------------------------------------------------------------------------------The Java Service Wrapper is an application that has evolved out of a desire to solve a number of problems common to many Java applications. Some of the Wrapper's features are: * Run a Java application as a Windows Service or Unix Daemon * Java Application Reliability * Automatic detection and recovery of Crashes Freezes and Deadlocks * On-Demand Restarts * Standard Out-of-the Box Scripting * Flexible Cross-Platform Configuration * Ease Application Installations * Logging * Many more...See our Product Features page for a more detailed feature list: => https://wrapper.tanukisoftware.com/doc/english/product-features.htmlFor more information please visit: => https://wrapper.tanukisoftware.com/doc/english/introduction.html2. Documentation-------------------------------------------------------------------------------Please visit our website for the full documentation.Here are some ways to get you started. * Complete documentation can be found online: => https://wrapper.tanukisoftware.com/ * How to integrate the Java Service Wrapper with an Application: => https://wrapper.tanukisoftware.com/doc/english/integrate.html * Configuration Properties: => https://wrapper.tanukisoftware.com/doc/english/properties.html * HOWTOs: => https://wrapper.tanukisoftware.com/doc/english/howto.html * Javadocs for advanced users: => https://wrapper.tanukisoftware.com/doc/english/javadocs.html * Tanuki Software Ltd. Corporate site: => https://www.tanukisoftware.com/3. Installation-------------------------------------------------------------------------------If you are reading this it means you have successfully unpacked this software.The Standard and Professional Editions of the Java Service Wrapper ship witha time-limited but full-featured trial license key which allows you to runthe Wrapper as many times as you want for up to 15 minutes. This is meantfor quick no-hassle testing.You can also request a FREE 1-month trial license that allows you to run theWrapper for the validity of the license (one month) on a single server withoutthe 15-minute limit per session.Trial licenses can be obtained at the following URL: => https://wrapper.tanukisoftware.com/doc/english/requestTrial.jspPermanent licenses can be purchased at the following URL: => https://wrapper.tanukisoftware.com/doc/english/accountLicenses.jspIf you have already purchased a license you can generate and
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_de.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_en.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_es.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_ja.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\doc\wrapper-development-license-1.3.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\doc\wrapper-server-license-1.3.txt Jump to behavior
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: certificate valid
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\jenkins-agent\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.59-pro\src\c\wrapperJNI64_VC8__Win32_Release\wrapper.pdb source: wrapper.dll.0.dr
Source: Binary string: C:\jenkins-agent\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.59-pro\src\c\wrapper64_VC8__Win32_Release\wrapper.pdb source: wrapper.exe.0.dr
Source: Binary string: C:\jenkins-agent\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.59-pro\src\c\wrapperw32_VC8__Win32_Release\wrapperw.pdb source: wrapperw.exe.0.dr
Source: revisions.txt.0.dr String found in binary or memory: http://bugs.sun.com/view_bug.do?bug_id=6965962
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: wrapper-windows-x86-64-3.5.59-pro.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: wrapper.exe.0.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: demoapp.conf.0.dr, wrapper.conf.0.dr, wrapper.conf.in.0.dr String found in binary or memory: http://wrapper.tanukisoftware.com/doc/english/integrate.html
Source: TestWrapper.bat.0.dr, StartTestWrapper-NT.bat.0.dr, AppTemplate.bat.in.0.dr, AppTemplatePassThrough.bat.in.0.dr, DemoApp.bat.0.dr, ResumeApp-NT.bat.in.0.dr, StopTestWrapper-NT.bat.0.dr, App.bat.in.0.dr, TestWrapperCommand.bat.0.dr, TeardownApp.bat.in.0.dr, InstallApp-NT.bat.in.0.dr, AppNoWrapper.bat.in.0.dr, InstallTestWrapper-NT.bat.0.dr, StopApp-NT.bat.in.0.dr, TeardownTestWrapper.bat.0.dr, PauseTestWrapper-NT.bat.0.dr, QueryTestWrapper-NT.bat.0.dr, GetHostId.bat.0.dr, UninstallApp-NT.bat.in.0.dr, SetupApp.bat.in.0.dr, QueryApp-NT.bat.in.0.dr String found in binary or memory: http://wrapper.tanukisoftware.com/doc/english/licenseOverview.html
Source: wrapper.conf.in_ja.0.dr String found in binary or memory: http://wrapper.tanukisoftware.com/doc/japanese/integrate.html
Source: demoapp.conf.0.dr, wrapper.conf.0.dr, wrapper-license.conf.0.dr, wrapper-license-time.conf.0.dr, wrapper.conf.in_ja.0.dr, wrapper.conf.in.0.dr String found in binary or memory: http://wrapper.tanukisoftware.com/purchase
Source: demoapp.conf.0.dr, wrapper.conf.0.dr, wrapper-license.conf.0.dr, wrapper-license-time.conf.0.dr, wrapper.conf.in_ja.0.dr, wrapper.conf.in.0.dr String found in binary or memory: http://wrapper.tanukisoftware.com/trial
Source: index.html.0.dr, wrapper-development-license-1.3.txt.0.dr, wrapper-server-license-1.3.txt.0.dr String found in binary or memory: http://wrapper.tanukisoftware.org
Source: revisions.txt.0.dr String found in binary or memory: http://wrapper.tanukisoftware.org/doc/english/licenseOverview.html
Source: index.html.0.dr String found in binary or memory: http://wrapper.tanukisoftware.org/jdoc/index.html
Source: TestWrapper.bat.0.dr, StartTestWrapper-NT.bat.0.dr, AppTemplate.bat.in.0.dr, AppTemplatePassThrough.bat.in.0.dr, DemoApp.bat.0.dr, ResumeApp-NT.bat.in.0.dr, StopTestWrapper-NT.bat.0.dr, App.bat.in.0.dr, TestWrapperCommand.bat.0.dr, TeardownApp.bat.in.0.dr, InstallApp-NT.bat.in.0.dr, AppNoWrapper.bat.in.0.dr, InstallTestWrapper-NT.bat.0.dr, StopApp-NT.bat.in.0.dr, TeardownTestWrapper.bat.0.dr, PauseTestWrapper-NT.bat.0.dr, QueryTestWrapper-NT.bat.0.dr, GetHostId.bat.0.dr, UninstallApp-NT.bat.in.0.dr, SetupApp.bat.in.0.dr, QueryApp-NT.bat.in.0.dr String found in binary or memory: http://www.tanukisoftware.com
Source: wrapper-windows-x86-64-3.5.59-pro.exe, wrapper.dll.0.dr, wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: https://sectigo.com/CPS0
Source: notepad.exe, 00000009.00000002.2486216320.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wrapper.tan
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr, README_ja.txt.0.dr, README_de.txt.0.dr, README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr, README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/
Source: wrapper-windows-x86-64-3.5.59-pro.exe, 00000000.00000002.1496372828.00000000009A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wrapper.tanukisoftware.com/doc/
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/accountDevLicenses.jsp
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/accountLicenses.jsp
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/accountServerLicenses.jsp
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/debugging.html
Source: notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/download.jsp
Source: notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/faq.html
Source: notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/howto-upgrade.html
Source: README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/howto.html
Source: wrapper_de.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/integrate.html
Source: wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/integrate.htmlThe
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/introduction.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/javadocs.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/licenseOverview.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/product-features.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/properties.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/qna.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/requestTrial.jsp
Source: wrapperTestApp_de.mo.0.dr, wrapperTestApp_ja.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/security-model.html
Source: wrapperTestApp_de.mo.0.dr, wrapperTestApp_ja.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/security-model.htmlThrow
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/support.jsp
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/supported-platforms.html
Source: notepad.exe, 00000009.00000002.2486216320.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/english/troubleshooting.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/accountDevLicenses.jsp
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/accountLicenses.jsp
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/accountServerLicenses.jsp
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/debugging.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/download.jsp
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/faq.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/howto-upgrade.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/howto.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/integrate.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/introduction.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/javadocs.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/licenseOverview.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/properties.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/qna.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/requestTrial.jsp
Source: wrapperTestApp_de.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/security-model.html
Source: wrapperTestApp_de.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/security-model.htmlGibt
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/support.jsp
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/supported-platforms.html
Source: README_de.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/german/troubleshooting.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/accountDevLicenses.jsp
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/accountLicenses.jsp
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/accountServerLicenses.jsp
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/debugging.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/download.jsp
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/faq.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/howto-upgrade.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/howto.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/integrate.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/introduction.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/javadocs.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/licenseOverview.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/product-features.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/properties.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/qna.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/requestTrial.jsp
Source: wrapperTestApp_ja.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/security-model.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/support.jsp
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/supported-platforms.html
Source: README_ja.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/japanese/troubleshooting.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/accountDevLicenses.jsp
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/accountLicenses.jsp
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/accountServerLicenses.jsp
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/debugging.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/download.jsp
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/faq.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/howto-upgrade.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/howto.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/integrate.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/introduction.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/javadocs.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/licenseOverview.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/product-features.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/properties.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/qna.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/requestTrial.jsp
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/support.jsp
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/supported-platforms.html
Source: README_es.txt.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/doc/spanish/troubleshooting.html
Source: wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/integrateGetNativeSystemInfokernel32.dllMicrosoft
Source: wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/purchaseYou
Source: wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com/trialLicense
Source: wrapperw.exe.0.dr, wrapper.exe.0.dr String found in binary or memory: https://wrapper.tanukisoftware.com2024GVBtWUThis
Source: wrapper_ja.mo.0.dr String found in binary or memory: https://wrapper.tanukisoftware.org/doc/japanese/integrate.html
Source: notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr, README_de.txt.0.dr String found in binary or memory: https://www.tanukisoftware.com/
Source: notepad.exe, 00000009.00000002.2486216320.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000009.00000003.1496079559.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, README_en.txt.0.dr, README_de.txt.0.dr String found in binary or memory: https://www.tanukisoftware.com/en/distributors.php
Source: README_es.txt.0.dr String found in binary or memory: https://www.tanukisoftware.com/es/
Source: README_es.txt.0.dr String found in binary or memory: https://www.tanukisoftware.com/es/distributors.php
Source: README_ja.txt.0.dr String found in binary or memory: https://www.tanukisoftware.com/ja/
Source: README_ja.txt.0.dr String found in binary or memory: https://www.tanukisoftware.com/ja/distributors.php
Sample file is different than original file name gathered from version info
Source: wrapper-windows-x86-64-3.5.59-pro.exe, 00000000.00000003.1494919897.0000000000A36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNOTEPAD.EXE.MUIj% vs wrapper-windows-x86-64-3.5.59-pro.exe
Source: wrapper-windows-x86-64-3.5.59-pro.exe, 00000000.00000003.1494919897.0000000000A36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNOTEPAD.EXEj% vs wrapper-windows-x86-64-3.5.59-pro.exe
Uses 32bit PE files
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: clean2.winEXE@3/59@0/0
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\AppData\Local\Temp\nsd7139.tmp Jump to behavior
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File read: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe "C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe"
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_en.txt
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_en.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: mrmcorer.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: efswrt.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\notepad.exe Window detected: -------------------------------------------------------------------------------Java Service Wrapper Professional Edition 3.5.59Copyright (C) 1999-2024 Tanuki Software Ltd. All Rights Reserved.https://wrapper.tanukisoftware.com-------------------------------------------------------------------------------Summary:1. What is the Java Service Wrapper?2. Documentation3. Installation4. License Options5. How to Purchase6. Getting Updates7. FAQ8. Support9. System Requirements1. What is the Java Service Wrapper?-------------------------------------------------------------------------------The Java Service Wrapper is an application that has evolved out of a desire to solve a number of problems common to many Java applications. Some of the Wrapper's features are: * Run a Java application as a Windows Service or Unix Daemon * Java Application Reliability * Automatic detection and recovery of Crashes Freezes and Deadlocks * On-Demand Restarts * Standard Out-of-the Box Scripting * Flexible Cross-Platform Configuration * Ease Application Installations * Logging * Many more...See our Product Features page for a more detailed feature list: => https://wrapper.tanukisoftware.com/doc/english/product-features.htmlFor more information please visit: => https://wrapper.tanukisoftware.com/doc/english/introduction.html2. Documentation-------------------------------------------------------------------------------Please visit our website for the full documentation.Here are some ways to get you started. * Complete documentation can be found online: => https://wrapper.tanukisoftware.com/ * How to integrate the Java Service Wrapper with an Application: => https://wrapper.tanukisoftware.com/doc/english/integrate.html * Configuration Properties: => https://wrapper.tanukisoftware.com/doc/english/properties.html * HOWTOs: => https://wrapper.tanukisoftware.com/doc/english/howto.html * Javadocs for advanced users: => https://wrapper.tanukisoftware.com/doc/english/javadocs.html * Tanuki Software Ltd. Corporate site: => https://www.tanukisoftware.com/3. Installation-------------------------------------------------------------------------------If you are reading this it means you have successfully unpacked this software.The Standard and Professional Editions of the Java Service Wrapper ship witha time-limited but full-featured trial license key which allows you to runthe Wrapper as many times as you want for up to 15 minutes. This is meantfor quick no-hassle testing.You can also request a FREE 1-month trial license that allows you to run theWrapper for the validity of the license (one month) on a single server withoutthe 15-minute limit per session.Trial licenses can be obtained at the following URL: => https://wrapper.tanukisoftware.com/doc/english/requestTrial.jspPermanent licenses can be purchased at the following URL: => https://wrapper.tanukisoftware.com/doc/english/accountLicenses.jspIf you have already purchased a license you can generate and
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: certificate valid
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static file information: File size 2002192 > 1048576
Source: wrapper-windows-x86-64-3.5.59-pro.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\jenkins-agent\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.59-pro\src\c\wrapperJNI64_VC8__Win32_Release\wrapper.pdb source: wrapper.dll.0.dr
Source: Binary string: C:\jenkins-agent\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.59-pro\src\c\wrapper64_VC8__Win32_Release\wrapper.pdb source: wrapper.exe.0.dr
Source: Binary string: C:\jenkins-agent\workspace\wrapper\wrapper-64\wrapper_prerelease_3.5.59-pro\src\c\wrapperw32_VC8__Win32_Release\wrapperw.pdb source: wrapperw.exe.0.dr
Drops PE files
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\AppData\Local\Temp\nst714A.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\lib\wrapper.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapper.exe Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapperw.exe Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\AppData\Local\Temp\nst714A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\AppData\Local\Temp\nst714A.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_de.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_en.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_es.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_ja.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\doc\wrapper-development-license-1.3.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File created: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\doc\wrapper-server-license-1.3.txt Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst714A.tmp\LangDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Dropped PE file which has not been started: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\lib\wrapper.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Dropped PE file which has not been started: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapper.exe Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Dropped PE file which has not been started: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\bin\wrapperw.exe Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst714A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst714A.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File Volume queried: C:\Users\user\Desktop FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe File Volume queried: C:\Users\user\Desktop FullSizeInformation Jump to behavior
Source: revisions.txt.0.dr Binary or memory string: Azure or Hyper-V Virtual Machines.
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro.exe Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_en.txt Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\notepad.exe Queries volume information: C:\Users\user\Desktop\wrapper-windows-x86-64-3.5.59-pro\README_en.txt VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1532860 Sample: wrapper-windows-x86-64-3.5.... Startdate: 14/10/2024 Architecture: WINDOWS Score: 2 5 wrapper-windows-x86-64-3.5.59-pro.exe 3 89 2->5         started        file3 10 C:\Users\user\Desktop\...\wrapper.dll, PE32+ 5->10 dropped 12 C:\Users\user\Desktop\...\wrapperw.exe, PE32+ 5->12 dropped 14 C:\Users\user\Desktop\...\wrapper.exe, PE32+ 5->14 dropped 16 3 other files (none is malicious) 5->16 dropped 8 notepad.exe 5 5->8         started        process4
⊘No contacted IP infos