Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

JabraDirectSetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

3cf367.rbf (copy)

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\AvayaIPIntegration\AvayaIPIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\AvayaIPIntegration\AvayaIP_InterfaceApi.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\AvayaOneXIntegration\AvayaOneXIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\AvayaOneXV3Integration\Autofac.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\AvayaOneXV3Integration\AvayaOneXV3Integration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\BroadSoftIntegration\BroadSoftIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\CiscoIPCommunicatorIntegration\CiscoIPCommunicator_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\CiscoJabberIntegration\CiscoJabberIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\CiscoUCIntegration\CiscoUCIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\CiscoWebExConnectIntegration\CiscoWebExConnectIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\CiscoWebExConnectIntegration\GNDeviceInterface.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\CounterpathBriaIntegration\CounterpathBriaIntegration_Part.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\BluecorePsKeyApi.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\DeviceInfo.xml

XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\DfuEngine.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\DfuEngineWrapper.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\FwVersionConstraints.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.CommandLineParser.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.BluecorePsKeyApi.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.Conexant.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.CphAdvance.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.Csr.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.CsrOta.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.CsrUsbOta.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.DeviceAdapter.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.DfuEngine.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.Factories.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.MassStorage.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.MxUvc.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.QualcommHid.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.Sitel.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FirmwareUpdate.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.FwBuildVectorReader.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.GnProtocol.UsbHid.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.GnProtocol.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.ModelBase.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.PanaCast.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.UsbDeviceInformation.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.UsbDeviceScanning.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.DeviceApis.UsbHidDevices.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\GNAudio.FirmwareUpdate.DeviceFirmwareUpdateInfo.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\JabraCmdlineFwUpdater.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\JabraCmdlineFwUpdater.exe.config

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\Microsoft.Bcl.AsyncInterfaces.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\Microsoft.VC80.CRT.manifest

XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\MxUvcFwu.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\MxUvcFwuWrapper.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\PanaCastAPI.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\PanaCastAPIWrapper.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\SitelHidFwu.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\SitelHidFwuWrapper.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Buffers.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Memory.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Numerics.Vectors.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Runtime.CompilerServices.Unsafe.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Text.Encodings.Web.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Text.Json.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.Threading.Tasks.Extensions.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\System.ValueTuple.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\TestEngine.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\msvcp80.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\msvcr80.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\FWU\pttransport.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\LICENSE

ASCII text

dropped

C:\Program Files (x86)\Jabra\Direct4\LICENSES.chromium.html

HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\LyncIntegration\default.xml

XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\NEC SP 350 Integration\GNDeviceInterface.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

modified

C:\Program Files (x86)\Jabra\Direct4\ZoomIntegration\Autofac.dll

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\chrome_100_percent.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\chrome_200_percent.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\d3dcompiler_47.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\ffmpeg.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\icudtl.dat

data

dropped

C:\Program Files (x86)\Jabra\Direct4\jabra-direct.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\libEGL.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\libGLESv2.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\am.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ar.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\bg.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\bn.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ca.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\cs.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\da.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\de.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\el.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\en-GB.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\en-US.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\es-419.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\es.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\et.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\fa.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\fi.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\fil.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\fr.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\gu.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\he.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\hi.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\hr.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\hu.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\id.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\it.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ja.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\kn.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ko.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\lt.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\lv.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ml.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\mr.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ms.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\nb.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\nl.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\pl.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\pt-BR.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\pt-PT.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ro.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ru.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\sk.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\sl.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\sr.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\sv.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\sw.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\ta.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\te.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\th.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\tr.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\uk.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\vi.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\zh-CN.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\locales\zh-TW.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\resources.pak

data

dropped

C:\Program Files (x86)\Jabra\Direct4\resources\app.asar

data

dropped

C:\Program Files (x86)\Jabra\Direct4\resources\app.asar.unpacked\node_modules\@gnaudio\jabra-node-sdk\build\Release\libjabra.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\resources\app.asar.unpacked\node_modules\@gnaudio\jabra-node-sdk\build\Release\sdkintegration.node

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\resources\app.asar.unpacked\node_modules\applicationinsights-native-metrics\build\Release\native_metrics.node

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\resources\app.asar.unpacked\node_modules\panacastapi\build\Release\panacastapi.node

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\snapshot_blob.bin

data

dropped

C:\Program Files (x86)\Jabra\Direct4\swiftshader\libEGL.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\swiftshader\libGLESv2.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\v8_context_snapshot.bin

data

dropped

C:\Program Files (x86)\Jabra\Direct4\version

ASCII text, with no line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\vk_swiftshader.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Jabra\Direct4\vk_swiftshader_icd.json

ASCII text, with no line terminators

dropped

C:\Program Files (x86)\Jabra\Direct4\vulkan-1.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\ProgramData\Package Cache\.unverified\DFUDriverSetupX64Setup.msi (copy)

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: DFUDriverSetupX64Setup, Author: GN Netcom A/S, Keywords: Installer, Comments: This installer database contains the logic and data required to install DFUDriverSetupX64Setup., Template: Intel;1033, Revision Number: {7963E9FB-725D-4343-A916-B8153882B1F1}, Create Time/Date: Wed Apr 28 11:13:02 2021, Last Saved Time/Date: Wed Apr 28 11:13:02 2021, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2

dropped

C:\ProgramData\Package Cache\.unverified\JabraDirect.msi (copy)

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Jabra Direct, Author: GN Audio A/S, Keywords: Installer, Comments: This installer database contains the logic and data required to install Jabra Direct., Template: Intel;1033, Revision Number: {DE4E175C-DDE6-476B-99A0-8B5D3A2341CF}, Create Time/Date: Mon Mar 7 18:17:12 2022, Last Saved Time/Date: Mon Mar 7 18:17:12 2022, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2

dropped

C:\ProgramData\Package Cache\{316F5FBF-4536-4A14-8D29-C1A9A8D800B6}v5.12.06601\JabraDirect.msi (copy)

dropped

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\state.rsm

data

dropped

C:\ProgramData\Package Cache\{D662C345-04FD-4F6C-AB68-B9BC6D6A5D2F}v7.0.32822.0\DFUDriverSetupX64Setup.msi (copy)

dropped

C:\Users\user\AppData\Local\Temp\DELC182.tmp (copy)

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\Background.png

PNG image data, 581 x 291, 8-bit colormap, interlaced

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\BootstrapperApplicationData.xml

XML 1.0 document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\license.rtf

Rich Text Format data, version 1, ANSI

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\logo.png

PNG image data, 581 x 291, 8-bit colormap, interlaced

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\thm.wxl

XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\thm.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\{332EE04F-741A-4188-8924-1DBA26FBF992}\.ba\wixstdba.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Installer\3cf364.msi

dropped

C:\Windows\Installer\MSI1D05.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Installer\MSI3570.tmp

data

dropped

C:\Windows\Installer\MSI38BC.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

UTF-8 Unicode (with BOM) text, with CRLF line terminators

dropped

C:\Windows\SysWOW64\concrt140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\Background.png

PNG image data, 581 x 291, 8-bit colormap, interlaced

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\BootstrapperApplicationData.xml

XML 1.0 document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\license.rtf

Rich Text Format data, version 1, ANSI

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\logo.png

PNG image data, 581 x 291, 8-bit colormap, interlaced

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\thm.wxl

XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\thm.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.ba\wixstdba.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.be\JabraDirectSetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\DFUDriverSetupX64Setup.msi

dropped

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\JabraDirect.msi

dropped

C:\Windows\Temp\{E08359EB-BFFA-49B5-8115-528C8789A364}\.cr\JabraDirectSetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Temp\~DF131044FCCF062C91.TMP

data

dropped

C:\Windows\Temp\~DF7460504A156BF38D.TMP

Composite Document File V2 Document, Cannot read section info

dropped

There are 168 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\JabraDirectSetup.exe

"C:\Users\user\Desktop\JabraDirectSetup.exe"

C:\Windows\Temp\{E08359EB-BFFA-49B5-8115-528C8789A364}\.cr\JabraDirectSetup.exe

"C:\Windows\Temp\{E08359EB-BFFA-49B5-8115-528C8789A364}\.cr\JabraDirectSetup.exe" -burn.clean.room="C:\Users\user\Desktop\JabraDirectSetup.exe" -burn.filehandle.attached=572 -burn.filehandle.self=568

C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.be\JabraDirectSetup.exe

"C:\Windows\Temp\{240BAF75-3E5B-4E93-8F26-E04B9DE786C2}\.be\JabraDirectSetup.exe" -q -burn.elevated BurnPipe.{D9E1E3E0-161A-4566-8CAE-5A87964B54C8} {D37BA658-0E76-49AC-BEF7-9E23554C8C54} 1120

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe

"C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe" /burn.runonce

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe" /burn.log.append "C:\Users\user\AppData\Local\Temp\Jabra_Direct_20220923074951.log

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe" -burn.clean.room="C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\user\AppData\Local\Temp\Jabra_Direct_20220923074951.log

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 094F350B1881CEA527676BAF5570DA2D

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\\System32\taskkill.exe" /F /IM jabra-direct.exe

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe

"C:\ProgramData\Package Cache\{50c3bcea-1203-4bf1-9103-09af1bf52966}\JabraDirectSetup.exe" -q -burn.elevated BurnPipe.{9C247021-F0C8-4FC2-9304-77A36769657D} {3D1A53A5-B618-4AC6-9F29-86FEE8B34C1A} 1240

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

There are 2 hidden processes, click here to show them.

URLs

Name

Malicious

http://service.conversation.v2.soap.uc.cisco.com/startConversation

unknown

http://client.system.v2.soap.uc.cisco.comT

unknown

http://service.phone.v2.soap.uc.cisco.com/unsubscribe

unknown

http://service.system.v2.soap.uc.cisco.com/getCredentials

unknown

http://service.system.v2.soap.uc.cisco.com/registerClient

unknown

https://support.google.com/chrome/answer/6098869

unknown

http://client.audio.v2.soap.uc.cisco.com/onAudioSnapshot

unknown

http://service.audio.v2.soap.uc.cisco.com/setCurrentOutputVolume

unknown

http://client.system.v2.soap.uc.cisco.comf

unknown

http://client.config.v2.soap.uc.cisco.comT

unknown

http://service.phone.v2.soap.uc.cisco.com/subscribe

unknown

http://service.conversation.v2.soap.uc.cisco.com/unsubscribe

unknown

http://service.conversation.v2.soap.uc.cisco.com/addMediaToConversation

unknown

http://service.system.v2.soap.uc.cisco.comTU

unknown

http://service.device.v1.soap.uc.cisco.com/setDefaultLine

unknown

http://client.audio.v2.soap.uc.cisco.com/onDefaultInputVolumeUpdated_

unknown

http://client.system.v2.soap.uc.cisco.com9

unknown

http://service.phone.v2.soap.uc.cisco.com/resume

unknown

http://client.config.v2.soap.uc.cisco.com/onConfigDataDeletedW

unknown

http://wixtoolset.org

unknown

https://bugs.chromium.org/p/chromium/issues/entry?template=Safety

unknown

http://service.audio.v2.soap.uc.cisco.com/setVoiceActivityDetectionParameters

unknown

http://service.phone.v2.soap.uc.cisco.com/sendDtmfTone

unknown

http://service.audio.v2.soap.uc.cisco.com/setRingerDevice

unknown

http://service.phone.v2.soap.uc.cisco.com/setDoNotDisturb

unknown

http://service.device.v2.soap.uc.cisco.com/setDeviceAlias

unknown

http://client.phone.v2.soap.uc.cisco.com/onErrorU

unknown

http://service.system.v2.soap.uc.cisco.com/unregisterClient

unknown

http://client.device.v2.soap.uc.cisco.com/onErrorT

unknown

http://service.system.v2.soap.uc.cisco.com/setServerAddressTypes

unknown

http://service.audio.v2.soap.uc.cisco.com/getDefaultInputVolume

unknown

http://client.conversation.v2.soap.uc.cisco.com/onRemoteMediaOffered_

unknown

http://config.v2.soap.uc.cisco.com/types

unknown

http://client.audio.v2.soap.uc.cisco.com/onCurrentInputVolumeUpdated

unknown

http://client.phone.v2.soap.uc.cisco.com/onPhoneParticipantUpdatedU

unknown

https://www.jabra.com/direct

unknown

http://client.device.v2.soap.uc.cisco.como

unknown

http://client.device.v2.soap.uc.cisco.coml

unknown

http://client.device.v2.soap.uc.cisco.comm

unknown

http://service.audio.v2.soap.uc.cisco.com/setEchoCancellationParameters

unknown

http://service.phone.v2.soap.uc.cisco.com/completeAttendedTransfer

unknown

http://client.device.v2.soap.uc.cisco.comj

unknown

http://www.symauth.com/cps0(

unknown

http://client.presence.v2.soap.uc.cisco.com/onSubscriptionRequest

unknown

http://service.presence.v2.soap.uc.cisco.com/setPrivacyListT

unknown

http://service.config.v2.soap.uc.cisco.comT

unknown

http://wixtoolset.org/schemas/thmutil/2010(

unknown

http://www.opensource.org/licenses/cpl1.0.txt

unknown

http://service.audio.v2.soap.uc.cisco.com/getAutomaticGainControlParameters

unknown

http://device.v2.soap.uc.cisco.com/types

unknown

http://client.system.v2.soap.uc.cisco.comm

unknown

http://service.conversation.v2.soap.uc.cisco.com/merge

unknown

http://client.system.v2.soap.uc.cisco.comn

unknown

http://www.symauth.com/rpa00

unknown

http://client.system.v2.soap.uc.cisco.comr

unknown

http://service.audio.v2.soap.uc.cisco.com/getEchoCancellationParameters

unknown

http://client.device.v2.soap.uc.cisco.comT

unknown

http://service.audio.v2.soap.uc.cisco.com/setAutomaticGainControlParameters

unknown

http://client.audio.v2.soap.uc.cisco.com/onDeviceUnpluggedW

unknown

http://service.device.v2.soap.uc.cisco.com/unsubscribe

unknown

http://client.conversation.v2.soap.uc.cisco.com/onCapabilitiesUpdatedk

unknown

http://client.conversation.v2.soap.uc.cisco.com/onParticipantChanged

unknown

http://service.audio.v2.soap.uc.cisco.com/getAudioOutputDevice

unknown

http://client.audio.v2.soap.uc.cisco.com(

unknown

http://service.device.v2.soap.uc.cisco.com/disableDeviceSelectionEvents

unknown

http://service.audio.v2.soap.uc.cisco.com/setOutputLowFreqRolloff

unknown

http://service.presence.v2.soap.uc.cisco.com/unsubscribeT

unknown

http://client.presence.v2.soap.uc.cisco.com/onDerivedPresenceUpdatedZ

unknown

http://service.config.v2.soap.uc.cisco.com/subscribe

unknown

http://service.presence.v2.soap.uc.cisco.com/subscribeT

unknown

http://www.unicode.org/copyright.html

unknown

http://service.phone.v2.soap.uc.cisco.com/getVoicemailPilotNumber

unknown

http://service.presence.v2.soap.uc.cisco.com/initializeT

unknown

http://client.audio.v2.soap.uc.cisco.comT

unknown

http://client.conversation.v2.soap.uc.cisco.com/onConversationEnded

unknown

http://client.conversation.v2.soap.uc.cisco.com/onParticipantAdded

unknown

http://service.phone.v2.soap.uc.cisco.com/enableMobility

unknown

http://client.config.v2.soap.uc.cisco.com/onConfigDataCreatedW

unknown

http://service.conversation.v2.soap.uc.cisco.com/unmute

unknown

https://www.jabra.com

unknown

http://service.phone.v2.soap.uc.cisco.com/getCallStatistics

unknown

http://service.audio.v2.soap.uc.cisco.com/getNoiseSuppressionParameters

unknown

https://www.jabra.com/directd=am

unknown

http://client.audio.v2.soap.uc.cisco.comw

unknown

http://client.audio.v2.soap.uc.cisco.com/onInputDeviceRemovedX

unknown

http://client.audio.v2.soap.uc.cisco.comx

unknown

http://client.audio.v2.soap.uc.cisco.comn

unknown

http://client.audio.v2.soap.uc.cisco.comq

unknown

http://client.conversation.v2.soap.uc.cisco.com/onParticipantRemovedg

unknown

http://client.audio.v2.soap.uc.cisco.com/onDevicePluggedInT

unknown

http://client.audio.v2.soap.uc.cisco.comp

unknown

http://service.presence.v2.soap.uc.cisco.com/setPresenceT

unknown

http://client.phone.v2.soap.uc.cisco.com/onCapabilitiesUpdated

unknown

http://service.device.v2.soap.uc.cisco.com/setPhoneMode

unknown

http://system.v2.soap.uc.cisco.com/types

unknown

http://autofac.org8

unknown

http://client.system.v2.soap.uc.cisco.com/onSystemSnapshotY

unknown

http://service.system.v2.soap.uc.cisco.com/setLogLevel

unknown

http://client.audio.v2.soap.uc.cisco.comm

unknown

http://service.conversation.v2.soap.uc.cisco.comT

unknown

There are 90 hidden URLs, click here to show them.

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleCachePath

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleUpgradeCode

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleAddonCode

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleDetectCode

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundlePatchCode

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleVersion

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

VersionMajor

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

VersionMinor

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleProviderKey

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleTag

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

EngineVersion

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

DisplayIcon

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

DisplayName

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

DisplayVersion

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

Publisher

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

HelpLink

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

URLInfoAbout

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

URLUpdateInfo

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

NoModify

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

QuietUninstallString

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

UninstallString

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

EstimatedSize

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{50c3bcea-1203-4bf1-9103-09af1bf52966}

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{50c3bcea-1203-4bf1-9103-09af1bf52966}

Version

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{50c3bcea-1203-4bf1-9103-09af1bf52966}

DisplayName

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

Resume

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce

{50c3bcea-1203-4bf1-9103-09af1bf52966}

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{50c3bcea-1203-4bf1-9103-09af1bf52966}

BundleResumeCommandLine

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{316F5FBF-4536-4A14-8D29-C1A9A8D800B6}

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{316F5FBF-4536-4A14-8D29-C1A9A8D800B6}

Version

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{316F5FBF-4536-4A14-8D29-C1A9A8D800B6}

DisplayName

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000

Sequence

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

C:\Config.Msi\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts

C:\Config.Msi\3cf366.rbs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts

C:\Config.Msi\3cf366.rbsLow

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3D74DB07FACE9814F9C80831D0247C57