hxxps://www[.]poly[.]com/us/en/support/downloads-apps/hub-desktop

Analysis

max time kernel
150s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
15-01-2021 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.poly.com/us/en/support/downloads-apps/hub-desktop
Sample

210115-43qggd9zfe

Score

10^/10

discovery evasion macro persistence trojan xlm

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Executes dropped EXE 7 IoCs

Processes:

PlantronicsHubInstaller.exePlantronicsHubInstaller.exePlantronicsHubBootstrapper.exeOldMHUUninstaller.exeOldMHUUninstaller.exeOldMHUUninstaller.exeSpokesUpdateService.exe

pid	process
4724	PlantronicsHubInstaller.exe
2244	PlantronicsHubInstaller.exe
2852	PlantronicsHubBootstrapper.exe
4764	OldMHUUninstaller.exe
4692	OldMHUUninstaller.exe
1092	OldMHUUninstaller.exe
936	SpokesUpdateService.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\OldMHUUninstallerMSI	office_xlm_macros

Loads dropped DLL 11 IoCs

Processes:

PlantronicsHubInstaller.exeOldMHUUninstaller.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
2244	PlantronicsHubInstaller.exe
4692	OldMHUUninstaller.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
476	MsiExec.exe
2544	MsiExec.exe
3196	MsiExec.exe
4404	MsiExec.exe
4404	MsiExec.exe
3196	MsiExec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exePlantronicsHubBootstrapper.exeOldMHUUninstaller.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PLTHub.exe = "C:\\Program Files (x86)\\Plantronics\\Spokes3G\\PLTHub.exe -min"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	PlantronicsHubBootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c0ef003d-7840-4201-94f0-69a1aa26aa94} = "\"C:\\ProgramData\\Package Cache\\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\\PlantronicsHubBootstrapper.exe\" /burn.runonce"	PlantronicsHubBootstrapper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	OldMHUUninstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2895da4c-a4e1-44b8-b138-b34139f9acaa} = "\"C:\\ProgramData\\Package Cache\\{2895da4c-a4e1-44b8-b138-b34139f9acaa}\\OldMHUUninstaller.exe\" /burn.runonce"	OldMHUUninstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

PlantronicsHubInstaller.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PlantronicsHubInstaller.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

JavaScript code in executable 15 IoCs

Processes:

yara_rule
js
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe.86ovgyo.partial	js
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{177F4689-8428-4F33-AA32-CEB37FA1968A}\.cr\PlantronicsHubInstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{177F4689-8428-4F33-AA32-CEB37FA1968A}\.cr\PlantronicsHubInstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.be\PlantronicsHubBootstrapper.exe	js
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.be\PlantronicsHubBootstrapper.exe	js
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\OldMHUUninstaller	js
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\PLTHub_x64	js
C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{C41B7A53-9A30-4C51-8653-D2B3DBF274CB}\.cr\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{C41B7A53-9A30-4C51-8653-D2B3DBF274CB}\.cr\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.be\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.be\OldMHUUninstaller.exe	js
C:\ProgramData\Package Cache\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\PlantronicsHubBootstrapper.exe	js

Drops file in System32 directory 29 IoCs

Processes:

DrvInst.exeMsiExec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_08d1c611bc4d16da\PLTCSRBCxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_2b13d4544d6cf2e6\calisto.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\SET778E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_08d1c611bc4d16da\csrbcx64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}\SET7BC4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}\SET7BC4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\csrbcx64.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}\SET7BC3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\SET777E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_08d1c611bc4d16da\PLTCSRBCxUSB.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}\Calisto.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\SET779F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}\SET7BC3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_2b13d4544d6cf2e6\calisto.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\SET777E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\SET778E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\PLTCSRBCxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1c80b26a-844c-0c43-8467-ff41a5928717}\calisto.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_2b13d4544d6cf2e6\Calisto.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\SET779F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{700000e5-c876-7a45-919b-f865a91d342c}\PLTCSRBCxUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_08d1c611bc4d16da\PLTCSRBCxUSB.inf	DrvInst.exe

Drops file in Program Files directory 125 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsGenesys.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsJabber.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\PLTHub.exe	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\DFUEngine.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ml.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\PlantronicsDevices.xml	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\Calisto\calisto.inf	msiexec.exe
File created	C:\Program Files\Plantronics\Spokes3G\Plugins\Plantronics.WMP.Plugin64.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\SwyxPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\PLTLyncInterface.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsZoom.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pltlocalcert.cer	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pltlocalcert.pem	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\vi.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\cef.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\fa.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\CsrDfu.exe	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\tr.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\hr.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsAvayaEquinox.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\sl.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\cef_200_percent.pak	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\CSR\pltcsrbcxusb.cat	msiexec.exe
File created	C:\PROGRA~1\DIFX\4CBAA680AB78144E\DIFxAppA.dll	MsiExec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ar.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsNEC.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\EmeraldDFUDynamic.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pshelp.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\es-419.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\fr.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\MadoneDFUDynamic.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\SpokesUpdateService.exe	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\ZoomClientSdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\nb.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsWMP.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\de.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\el.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\libcef.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\natives_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\nl.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\BTDeviceDFU.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\cef_100_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\da.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pttransport.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\ring.wav	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\TestEngine.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\HabitatSoundscaping.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\OTADFUDynamic.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\sr.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ta.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\uk.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ca.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\en-GB.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\fil.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\bn.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\HidDfu.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\icudtl.dat	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\sv.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\am.pak	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\CSR\PLTCSRBCxUSB.inf	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\pt-PT.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ro.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsTAPI.dll	msiexec.exe

Drops file in Windows directory 49 IoCs

Processes:

msiexec.exeMsiExec.exeDrvInst.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vccorlib140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vccorlib140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vcruntime140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7602.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vccorlib140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File created	C:\Windows\Installer\f764eb0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EAFAA581-9A28-4E49-8767-D4DA2A7149E6}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\msvcp140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f764eac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\concrt140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI508D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\concrt140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\msvcp140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vcruntime140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\Installer\{EAFAA581-9A28-4E49-8767-D4DA2A7149E6}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\f764ea9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C3A.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\concrt140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\concrt140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\msvcp140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vcruntime140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vcruntime140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\f764ead.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6631.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6266.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66DE.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\msvcp140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AA7.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI8AB5.tmp	msiexec.exe
File created	C:\Windows\Installer\f764ea9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5831.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vccorlib140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{EAFAA581-9A28-4E49-8767-D4DA2A7149E6}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E4ED21AA-A29D-4128-A771-2722A658FA68}	msiexec.exe
File created	C:\Windows\Installer\f764ead.msi	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 122 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDrvInst.exesvchost.exeDrvInst.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = de4ef1e88fadd601	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 111 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "297"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "792"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "209"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "488"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "534"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4231702938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "218"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "534"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "376"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "792"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "218"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "297"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "336"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "439"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "661"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "396"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "317435727"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "106"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30862037"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30862037"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "257"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "223"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "792"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "257"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "534"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4242953709"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "661"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "422"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "317484313"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27C1735C-56C9-11EB-BEBD-F648E9E4AC23} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "396"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000e715e03a89d6731321f04918842331a5808605f78a3d5b2d08e0fd72d49f2a0a000000000e800000000200002000000053db4f7defd685a5da2d52320743bdb05ca564b3bf6caa8bcc4d3556c8d5b0882000000024704c4a5990f1df5ce7d0aa3396a749a620dd3f489b813ee05a1860638f6f0a400000006973de0bb1842a6e383ce9f9da5d96422184fda0195a4a6954660861cd01b607ba4fbd8d66f8274ea9e752449d503fdb60341f2a1d76772f6868c7dff45b1a39	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "297"	IEXPLORE.EXE

Modifies data under HKEY_USERS 137 IoCs

Processes:

DrvInst.exeMsiExec.exeDrvInst.exesvchost.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 1153 IoCs

Processes:

PlantronicsHubBootstrapper.exemsiexec.exeOldMHUUninstaller.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{EAFAA581-9A28-4E49-8767-D4DA2A7149E6}	PlantronicsHubBootstrapper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{317F51C7-8EBB-4822-8BAD-1670C43B84C3}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6EBB6E9D-6693-4F57-98EE-F5195E8FFA0B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{750B4A16-1338-4DB0-85BB-C6C89E4CB9AC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCallCommand\CLSID\ = "{77AD0CF3-B32B-4975-9E51-C4162C234BEC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BA07181A-80C9-4844-A0AF-0CAB8CD70D1D}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53E6AB81-25DB-4273-981B-66B3486373F1}\InprocServer32\ = "C:\\Program Files\\Plantronics\\Spokes3G\\Plugins\\Plantronics.WMP.Plugin64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{317F51C7-8EBB-4822-8BAD-1670C43B84C3}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMSession.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMDeviceEventArgs\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7A670407-9187-44CC-AE10-3BC864C788CB}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87AA1CEB-3013-4249-8050-4CE19A216B39}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D8E006D0-E578-4FC1-847A-5205E3AC58F0}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF644C11-DF4A-45F6-8FD2-8C9939228EEE}\ProgID\ = "Plantronics.COMAALTWAReportEventArgs.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B1335F0E-4D45-48CD-A7DF-FF72C4A17B2A}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{94139D75-8EEC-479F-B8FB-8481109E04AE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{53E6AB81-25DB-4273-981B-66B3486373F1}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8B85DBBB-1485-4F7A-9650-30D90A2C45EE}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMSession\CurVer\ = "Plantronics.COMSession.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58E70C05-40D3-4361-93F4-C811581C00BA}\TypeLib\ = "{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCallInfo.1\CLSID\ = "{8A8ACA43-DE5F-48E9-ADAD-519458E4B136}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB2825B9-AA0C-4C96-9153-98CC7BE4701B}\TypeLib\ = "{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{52EB1EB4-6CF9-4675-9410-9508C3435807}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFE29ED7-0ACB-4D2E-9086-E6110C3D018B}\1.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1344BED51D7235A409CD703BECEB61E0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D74CDE86-9973-456A-91B0-FD438129F3A4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCall.1\CLSID\ = "{F8729099-4E9F-4135-A157-D6CADBECEA88}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMConversationDynamicsReportEventArgs\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{750D8D1E-783E-4D0D-9665-F88ED73F7228}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E4ED21AA-A29D-4128-A771-2722A658FA68}\ = "{E4ED21AA-A29D-4128-A771-2722A658FA68}"	OldMHUUninstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A8ACA43-DE5F-48E9-ADAD-519458E4B136}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2495E8BE-6C7D-4835-9326-1CFDADBAF99A}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1FE2761F-DABF-46A6-92A0-9FED3946BF51}\ = "ICOMBaseEventArgs"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\Dependents	PlantronicsHubBootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{317F51C7-8EBB-4822-8BAD-1670C43B84C3}\ProgID\ = "Plantronics.BatteryInfo.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A670407-9187-44CC-AE10-3BC864C788CB}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DECB63F9-CBBC-4930-969E-10BCD46E22C3}\ = "COMHostCommand Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7603AD35-B5D1-4711-A883-907B0E664BFD}\TypeLib\Version = "3.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{59FF1D66-CE98-4060-9F6D-4037EC23D39A}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.ClientLineMgrEventsImpl.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BF740951-34C8-4E8A-BE93-62EFEF0E6152}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{58E70C05-40D3-4361-93F4-C811581C00BA}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{750B4A16-1338-4DB0-85BB-C6C89E4CB9AC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCallCommand.1\ = "COMCallCommand Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4A305A6F-DB14-459F-A5C3-D56BBC8C1232}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECB9CBB5-7B1F-4DB7-8357-39B3B45BFFD3}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{317F51C7-8EBB-4822-8BAD-1670C43B84C3}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1A51193-3BFD-4B0D-A4EA-29FE3F2BA7CD}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{309910E1-E8F7-42D9-9101-6B1D73F8138C}\AppID = "{8B85DBBB-1485-4F7A-9650-30D90A2C45EE}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.DeviceListenerEventArgs\ = "COMDeviceListenerEventArgs Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D74CDE86-9973-456A-91B0-FD438129F3A4}\ProgID\ = "Plantronics.COMDevice.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMConversationDynamicsReportEventArgs\CurVer\ = "Plantronics.COMConversationDynamicsReportEventArgs.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMSession.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87AA1CEB-3013-4249-8050-4CE19A216B39}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{94660F69-7A31-476D-8F72-452F90FE4849}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7603AD35-B5D1-4711-A883-907B0E664BFD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47392DD9-0FB9-45A3-B50E-D369AC5C7E41}\TypeLib\Version = "3.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMDeviceEventArgs\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6EBB6E9D-6693-4F57-98EE-F5195E8FFA0B}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77AD0CF3-B32B-4975-9E51-C4162C234BEC}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMConversationDynamicsReportEventArgs\CurVer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\185AAFAE82A994E478764DADA217946E\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 502 IoCs

Processes:

msiexec.exeMsiExec.exe

pid	process
784	msiexec.exe
784	msiexec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 205 IoCs

Processes:

vssvc.exeOldMHUUninstaller.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	3460	vssvc.exe
Token: SeRestorePrivilege	3460	vssvc.exe
Token: SeAuditPrivilege	3460	vssvc.exe
Token: SeShutdownPrivilege	1092	OldMHUUninstaller.exe
Token: SeIncreaseQuotaPrivilege	1092	OldMHUUninstaller.exe
Token: SeSecurityPrivilege	784	msiexec.exe
Token: SeCreateTokenPrivilege	1092	OldMHUUninstaller.exe
Token: SeAssignPrimaryTokenPrivilege	1092	OldMHUUninstaller.exe
Token: SeLockMemoryPrivilege	1092	OldMHUUninstaller.exe
Token: SeIncreaseQuotaPrivilege	1092	OldMHUUninstaller.exe
Token: SeMachineAccountPrivilege	1092	OldMHUUninstaller.exe
Token: SeTcbPrivilege	1092	OldMHUUninstaller.exe
Token: SeSecurityPrivilege	1092	OldMHUUninstaller.exe
Token: SeTakeOwnershipPrivilege	1092	OldMHUUninstaller.exe
Token: SeLoadDriverPrivilege	1092	OldMHUUninstaller.exe
Token: SeSystemProfilePrivilege	1092	OldMHUUninstaller.exe
Token: SeSystemtimePrivilege	1092	OldMHUUninstaller.exe
Token: SeProfSingleProcessPrivilege	1092	OldMHUUninstaller.exe
Token: SeIncBasePriorityPrivilege	1092	OldMHUUninstaller.exe
Token: SeCreatePagefilePrivilege	1092	OldMHUUninstaller.exe
Token: SeCreatePermanentPrivilege	1092	OldMHUUninstaller.exe
Token: SeBackupPrivilege	1092	OldMHUUninstaller.exe
Token: SeRestorePrivilege	1092	OldMHUUninstaller.exe
Token: SeShutdownPrivilege	1092	OldMHUUninstaller.exe
Token: SeDebugPrivilege	1092	OldMHUUninstaller.exe
Token: SeAuditPrivilege	1092	OldMHUUninstaller.exe
Token: SeSystemEnvironmentPrivilege	1092	OldMHUUninstaller.exe
Token: SeChangeNotifyPrivilege	1092	OldMHUUninstaller.exe
Token: SeRemoteShutdownPrivilege	1092	OldMHUUninstaller.exe
Token: SeUndockPrivilege	1092	OldMHUUninstaller.exe
Token: SeSyncAgentPrivilege	1092	OldMHUUninstaller.exe
Token: SeEnableDelegationPrivilege	1092	OldMHUUninstaller.exe
Token: SeManageVolumePrivilege	1092	OldMHUUninstaller.exe
Token: SeImpersonatePrivilege	1092	OldMHUUninstaller.exe
Token: SeCreateGlobalPrivilege	1092	OldMHUUninstaller.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exePlantronicsHubInstaller.exe

pid process

4772 iexplore.exe
4772 iexplore.exe
2244 PlantronicsHubInstaller.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid process

4772 iexplore.exe
4772 iexplore.exe
3032 IEXPLORE.EXE
3032 IEXPLORE.EXE
3032 IEXPLORE.EXE
3032 IEXPLORE.EXE
2156 IEXPLORE.EXE
2156 IEXPLORE.EXE

pid	process
4772	iexplore.exe
4772	iexplore.exe
2244	PlantronicsHubInstaller.exe

pid	process
4772	iexplore.exe
4772	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

iexplore.exePlantronicsHubInstaller.exePlantronicsHubInstaller.exePlantronicsHubBootstrapper.exeOldMHUUninstaller.exeOldMHUUninstaller.exemsiexec.exesvchost.exe

description	pid	process	target process
PID 4772 wrote to memory of 3032	4772	iexplore.exe	IEXPLORE.EXE
PID 4772 wrote to memory of 3032	4772	iexplore.exe	IEXPLORE.EXE
PID 4772 wrote to memory of 3032	4772	iexplore.exe	IEXPLORE.EXE
PID 4772 wrote to memory of 2156	4772	iexplore.exe	IEXPLORE.EXE
PID 4772 wrote to memory of 2156	4772	iexplore.exe	IEXPLORE.EXE
PID 4772 wrote to memory of 2156	4772	iexplore.exe	IEXPLORE.EXE
PID 4772 wrote to memory of 4724	4772	iexplore.exe	PlantronicsHubInstaller.exe
PID 4772 wrote to memory of 4724	4772	iexplore.exe	PlantronicsHubInstaller.exe
PID 4772 wrote to memory of 4724	4772	iexplore.exe	PlantronicsHubInstaller.exe
PID 4724 wrote to memory of 2244	4724	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 4724 wrote to memory of 2244	4724	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 4724 wrote to memory of 2244	4724	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2244 wrote to memory of 2852	2244	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2244 wrote to memory of 2852	2244	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2244 wrote to memory of 2852	2244	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2852 wrote to memory of 4764	2852	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2852 wrote to memory of 4764	2852	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2852 wrote to memory of 4764	2852	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 4764 wrote to memory of 4692	4764	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 4764 wrote to memory of 4692	4764	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 4764 wrote to memory of 4692	4764	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 4692 wrote to memory of 1092	4692	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 4692 wrote to memory of 1092	4692	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 4692 wrote to memory of 1092	4692	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 784 wrote to memory of 2544	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 2544	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 2544	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 476	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 476	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 3196	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 3196	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 3196	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 4404	784	msiexec.exe	MsiExec.exe
PID 784 wrote to memory of 4404	784	msiexec.exe	MsiExec.exe
PID 856 wrote to memory of 2400	856	svchost.exe	DrvInst.exe
PID 856 wrote to memory of 2400	856	svchost.exe	DrvInst.exe
PID 856 wrote to memory of 192	856	svchost.exe	DrvInst.exe
PID 856 wrote to memory of 192	856	svchost.exe	DrvInst.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.poly.com/us/en/support/downloads-apps/hub-desktop
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4772 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4772 CREDAT:148483 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724

C:\Users\Admin\AppData\Local\Temp\{177F4689-8428-4F33-AA32-CEB37FA1968A}\.cr\PlantronicsHubInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\{177F4689-8428-4F33-AA32-CEB37FA1968A}\.cr\PlantronicsHubInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe" -burn.filehandle.attached=596 -burn.filehandle.self=604
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2244

C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.be\PlantronicsHubBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.be\PlantronicsHubBootstrapper.exe" -q -burn.elevated BurnPipe.{0F4DBDA5-21A0-4A23-A19A-3ED0713BAFB6} {FC935337-95B4-4F13-AFCF-7DED2A2A278B} 2244
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2852

C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe
"C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe" /install /quiet
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764

C:\Users\Admin\AppData\Local\Temp\{C41B7A53-9A30-4C51-8653-D2B3DBF274CB}\.cr\OldMHUUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\{C41B7A53-9A30-4C51-8653-D2B3DBF274CB}\.cr\OldMHUUninstaller.exe" -burn.clean.room="C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe" -burn.filehandle.attached=544 -burn.filehandle.self=512 /install /quiet
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4692

C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.be\OldMHUUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.be\OldMHUUninstaller.exe" -q -burn.elevated BurnPipe.{C54478A1-10EC-4E14-B21C-C0DCB1F16A87} {574B5D10-0DBC-42AE-8807-9AF55AF0133C} 4692
7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3460

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:428

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4B5F1F7141D0D77B11926E8B49C57113
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2544

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding AAAAC94D096D12F07B8AC2F9CB4AEA30
2⤵
- Loads dropped DLL
PID:476

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6C12F3FC7A23055E2AC5DEA7451625F9 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:3196

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 8B6F0039C09B3760DFFD21A8E72A1E1F E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4404

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Common Files\Plantronics\CSR\PLTCSRBCxUSB.inf" "9" "4e76be0af" "000000000000016C" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files\Common Files\Plantronics\CSR"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2400

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Common Files\Plantronics\Calisto\calisto.inf" "9" "4b46f3ba7" "0000000000000170" "WinSta0\Default" "0000000000000124" "208" "C:\Program Files\Common Files\Plantronics\Calisto"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:192

C:\Program Files (x86)\Plantronics\Spokes3G\SpokesUpdateService.exe
"C:\Program Files (x86)\Plantronics\Spokes3G\SpokesUpdateService.exe" install
1⤵
- Executes dropped EXE
PID:936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\COMMON~1\PLANTR~1\CSR\PLTCSRBCxUSB.cat
MD5
1ecf9040bf85534dd573ed9e6c7764e0

SHA1
f0c54f542957e5d3b31b82e28edee76831e0af9f

SHA256
ea05b02b9caec0e653a8437e01b93f6684a8ee51c44e704cfec81bff1031557a

SHA512
bad890ad6b1848f94af240f59aa5743deb335b6a288622195bfd1e1e4addefc33135e1a4eb3217e5fdd4dc55479114bffe65ea206fd7f8a455d6ce126cc3ebe6

Download Submit
C:\PROGRA~1\COMMON~1\PLANTR~1\CSR\csrbcx64.sys
MD5
c72d445d22c23a14b8b97e36699c22ae

SHA1
03b9c0284aa58c7b4631241b121bd43a36ce57b0

SHA256
d4940968abdbd714f3b98f395a9746d8fc0bd2b322b5eee6dd9ad791ff63bd54

SHA512
33b6cfc04c99517d019f292ba6da7b6904e0b5ab6ebc317606f28c916400f46a103bfc70a843a3c6b9f9ad1b58c5198697ad7641ca531d8fd901fa66ddb286df

Download Submit
C:\PROGRA~1\COMMON~1\PLANTR~1\Calisto\Calisto.cat
MD5
736da057af241071426d55704735a891

SHA1
1841be549d4092239b4ef9a1e16a9d8cd75ddf62

SHA256
caf830ff30e4111ab8ff7a36a94616ca0652a925c4d42dd0849a5cf4b9af06c9

SHA512
0caabdc08348cba5bd608bf306bb1b927a45d4839e7821a68c1f9d9b94a9796278617e8193cd7911ca374f71066117cc27dda215e2eb19c8f199c60100a14f8f

Download Submit
C:\Program Files\Common Files\Plantronics\CSR\PLTCSRBCxUSB.inf
MD5
c33678df9cdf9826e2301dbb526862be

SHA1
20c7eda3129b3ff8f72f9bf59252b718b554fbdc

SHA256
e730b076c3e90cfbc066117e84bcf21ccd44f5a17a1488cfc1b28eae6fbdd010

SHA512
9b17d7f2fe59161a4c6fa86b83e13988f19638bc39c0493cab653393ae1441d82210e9743b7bfa71dae51bb83c032b073691d83810f9500455f44ecc8ee84846

Download Submit
C:\Program Files\Common Files\Plantronics\Calisto\calisto.inf
MD5
9265714b944e10c81e4e275c27fcda42

SHA1
07afe62d73c8799e9e5689f86fb9f48389717ba3

SHA256
c3a3ed0a5139517be14e7288f5132eeacf0286f2328b9966557132f2fee4c5ce

SHA512
d31e5eac98c4a60031b06d480695c1b233fbda7ed394d47eb75130da4546c42944d5b6660f4691ed0a6fc1a92ed6de9183f7e3dfe7f2fe537649bbe31b20841b

Download Submit
C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe
MD5
c6495e8916dfaf9e983ae41eea111798

SHA1
568c7e338d8bd9134d64c59aca8b96af303b141b

SHA256
326e19483f1ac92c92c750e23a94e9354cb8ae745e023c82990757ad88ed546c

SHA512
3d05199a2f74467a8fc46bb4df2983060aa0f92f89cb461d1c6c3e531ee4c2765a0edb5c6e4fa9263502c55fee73db96ffd9f7648020bb3275fa9b84540968f2

Download Submit
C:\ProgramData\Package Cache\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\ProgramData\Package Cache\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\state.rsm
MD5
0504e9aee42c8668d1e4e9008858e253

SHA1
d6663d96bde0731dab700432bab080c183fc63df

SHA256
6f1873bf7c53d61524fba6418c2f95817ff1b2af02076d29e094e24bb74954cd

SHA512
54e7027e59c6aacbf6a810b22483b49210784befea3bd28f83c554b5238fb4840cae69188c5950f6a60645f8144ed54b84f95fe2d62e23590e9fc02a882c63be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
1c719258028a30f4c5c4b9927bca78b5

SHA1
74876832f8b66db34beda49067d1cdcb54a809f8

SHA256
c6a5befebb221e5937f4985c5aee4897942e9469ab7e93a11b7d05c33cfc57a5

SHA512
0c2059b78f00f5dbac85f91e6661734e9de9726948edbaf1ce1224a3156203072c40f61e00c0c5bbb5cab937e7026e4e90446e941e2d504ebcf9b877ab28e493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
0e7dd6f8883353918beab32df55a60ba

SHA1
df1d32b1478c2d9227d4964ca3a90217fd935daf

SHA256
fc0551d582084a0182a186afcae6e57638beb8386f0387d754123b4760015a1e

SHA512
e1532fe62eabd5df4af700bda9276040583af158db580e013a7fb8bbc551bf6ee0622874641cb960ddf129cb4eaa85520a81920608554c1c315d9b5464291070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
MD5
f0453022a3c4c7d62cba34ba5cea4c45

SHA1
35255f85ad99b7f033c40f1534c3c20bf7088f84

SHA256
bd62715094d50faf9134c39476dc4dcfc4231c254e152538e3661be17f93bba5

SHA512
60a6450748acda2f9dee36285ee8e2fca37d45e0b6edc06855ddc1f0d22b5f199f3d9d24a391af117c592065d6fe2ad7f5c713561b1ad1016dfa37d18826844a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_2B287B23632C44FDB851E8157EDB328B
MD5
40e755c183b3114c0053640ab8114fc0

SHA1
ddf9ae3e3c1c5a97c2126a9deac9ca7228b3f2c4

SHA256
d6c8d2049084db07944b384e995c3e3e902094ea6f0da5a32b67a9bb7aac590d

SHA512
9607a153e39b92088f3b3650f2de45342eec7f48f87f33a49f702a3d9ccd326b5afa40ac47b4c6fc50ffc0fb5b838ba660ba67ce777f40cdd131b62982a72848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
38dff11c0f4502f1aa69225460d88572

SHA1
0cbed044ed329b263bb0e21be42d4bd53f4dc68b

SHA256
2519fe8c797b6a371e757526285b83e54eb3bbe14b80d6d2d3dc73253d9b7482

SHA512
da733d04e0499e259ccbd303dd77fb756e5c53677105cb9fbaab04a1b177f99b0c70de9da010df7385c75000ee01b977d2c3e622815757eb47893b3fe71cc263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
06290412113efd72f13aca24d63de35d

SHA1
7389004fc48cff1c085d9cee5465c82108967baa

SHA256
c84af8dacdf7ee5da51b04c716d396ed37f0d04ba1366253e29629eebaa64916

SHA512
f1b0d2455d5ad877bde1be5eb4b0be4200da608d8dc5001df07b12e917ea12b2b5438b09a3e4345644eb19549f088bb28f8a2b1cc5c501fb8d19c845e598e536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
MD5
08617f5aa67d31f80f8dfab06ba6ffff

SHA1
ac13f5a9c1cc0376fbfc41771503e95071783772

SHA256
98912ed1476474384dd33d09859e35b725361a2bdfc74b34573a210db1a40370

SHA512
e5e06d66320a93bc13729c23b909e793efbbc2f37259f75022319f48cfc1352c7593d5eb0df7e96a7b74fb14f3de6e7b1fc41bdda570270f6a9e5d908a5fa1c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_2B287B23632C44FDB851E8157EDB328B
MD5
f3f6d33260d3ebbe54e54f3541b65fc6

SHA1
a14d6900552e129ad416d3a151692f3e74d3fba9

SHA256
5210aab8848a496fe9a08fc1883e5e00966b65919cce6b7c08bad194fd751b45

SHA512
389573faf7a41eb12e33a46683dac63d1795e57474d8cc841c0cdd63ea44db1a2290f0ff9fcdbda8702fccba28232aa0ffe2236e8e21cdf921ab6eeb26131142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe
MD5
1d9055556bc6054a8f73f2c3d348dd43

SHA1
f61afe22302ccb74b7a2a132e8d677eec289618d

SHA256
47f2f959582a2c63790d7997ba4ce9da283f97976260fe505a8d33e9f047e175

SHA512
a38d6e10cb6fede8e88a4c0459a84a9de29cf3afc670cafe99857818c8dcfbc364e718d53e7ba108d1f1d2c2515beb36db1044305b4643760b3e3a6841b3e929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\PlantronicsHubInstaller.exe.86ovgyo.partial
MD5
1d9055556bc6054a8f73f2c3d348dd43

SHA1
f61afe22302ccb74b7a2a132e8d677eec289618d

SHA256
47f2f959582a2c63790d7997ba4ce9da283f97976260fe505a8d33e9f047e175

SHA512
a38d6e10cb6fede8e88a4c0459a84a9de29cf3afc670cafe99857818c8dcfbc364e718d53e7ba108d1f1d2c2515beb36db1044305b4643760b3e3a6841b3e929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0KAT9UYV.cookie
MD5
b211385b45090738f046dd6f8c0d7292

SHA1
f8bb04d5ea4360fdd456c11b3deea25947eff0dc

SHA256
109aa9c9d813022692d4e7f739afab0a7ed60f28651b20f6603bebf0ef10eb05

SHA512
641dc7b03db3085c15543a21d12d2e6ba7d30931fba0cc3657b98f2e4bb5d8804913da10080d7ce7793227f509beb9fe6232bf6c9bcc59d7910b502087f32f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\2NN31MHY.cookie
MD5
d48b6b45b279dc835e31fc0172f3538c

SHA1
23f68aa6eade27e0b27087dfd17d313857753efa

SHA256
dc03506ec25950b28fa128b8bf1556150304b1798ed406b4fc6994ff0ad070b9

SHA512
fb585e2c41d2e6d73416ed506c55cc7364dfcab819e24ade8c11b53d2102af0201f8859407bbee73514063a41f1508778f464fe4ae617a7f92ae6e5bd484340d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\6CD5FVXK.cookie
MD5
acec185c742e812fe3e72fc0753c0389

SHA1
2a4cb449e825c5a23df0fcb89e20362e32ec24f7

SHA256
503dca7d34ed93456c5644da1ab6fecf73eb7aa32db456a14d506136df7e2981

SHA512
0802eb37eafcacb71ecabbc88f8894781ccfcd1eb27444d00ac545be74855b12dab83b3468db9f847364a6459bd76fa7f06f7535db55b93e0895386dcf815598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7C9LF5F4.cookie
MD5
3ac81a81bcdd0d645651237ca0483ced

SHA1
76dd15f45abd0257e4d206c55b7955d115181a72

SHA256
d4b95f7e4326a38c3af477e11e4f879f4f57d1d67e78ac408306be1e3cbcda6e

SHA512
a38aadf97e11cbd55ec868b5d947093dd764d7c017847f0cae60c0847e5e5df485c54f01aecc8093e06a1d3c544ad45ef0e5322a6ecbad2d951fe6700424aafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\AT3LACND.cookie
MD5
6396f0fd2236aa64c764f49431af079c

SHA1
d215f59dfae7141f478249b06d06294fd4520f15

SHA256
b1934a495378b74ca37647a1b7a7697a9d318f1f8071c5b14de29290f5120dcd

SHA512
aa2102271365ce5c0864d1f40058525856ae5db64d08735742d000fa452420778218d9ca4e660316c1ca3d9f97d824b71786bb9f70572ba009423034b8e404e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\J7IEZ2UN.cookie
MD5
98268807b73725e38b27a0ed97acb454

SHA1
b2015b13b4677b3a0a0942db49d1c14731b1789d

SHA256
ea74239b17b3761ac9d494038f2115618e15c0d967371d52cbcf41ca4b870df6

SHA512
1b63e00a83364183f1daff94bb8a1f124aea521ee8186503c1578f66eb63d7300ce6bc5c79b4a8ca459b8967e9e78b3d85d8f4de5e3eab4fb4c88308658908cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JIPVZAOF.cookie
MD5
4c2ffee161f4361e1e140d9192d743c6

SHA1
2fd71336615558ab062587008e7226c50f534ab7

SHA256
889aea08adaa53d4885e96b6a89527db3dac58fc247219fbd2a3c3e86bfea25f

SHA512
f423f2907729510d55f9c1a55274a3e35b6f68c56da93734bcd962d4e0e2a7d877e8ce128cc2b167f8a8be2f64489811ca6b52c05895f5c36924852624f6e888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\PX0QILI4.cookie
MD5
5e47658d6785e7a0f6214bdedd938f47

SHA1
238142429f60e4923d7f65da90fc4f19ab0b10ce

SHA256
d463b0879883db81f514e9d7295a0bde06c136c47cde33e4ff5ec33387dcf9d0

SHA512
8aa9eb8ac402043f98db42b942faf1ceeda63322740b2d77f3fd032a39b9aab95eaa756f5ce2612b997d88e8d68bf698d3ae9bb0ac549ede3e4b9e5edc8e4488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\UDKSBBOF.cookie
MD5
c4458abd921323bb2f1418d5233e8195

SHA1
961da029a5c1d511297b232313f1d2a040fb0151

SHA256
983435cd8b29deb2ba8b4f4d84c206655be7fe78c1e43b13f0dce10aed0c172b

SHA512
9db4e7271955402afa372d544e272212cc834dba2216448562ff2af948ff4681a5c25a89eb31e7752de918d58d6f1f46e891140951bc8b6f4ce5c72ca95ad29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OldMHUUninstaller_20210115003430_000_OldMHUUninstallerMSI.log
MD5
64262f8214870992fe2581bf17b36c15

SHA1
5a5b68aaf66751f41a17bf8234e51e6814d07508

SHA256
fe1900700a6e3a6879108aab4325981ed190227fab22c1d2b6d561de781e3536

SHA512
61c03299d0d3b2efa91e095b3bfc9ee67af8ac52c1fceaf42a274b2b482ecfa09ebf73e6e3bc2ba33d99bad4450f360cfbb2a4434ca8b4b40e2b712ddf418b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plantronics_Hub_Software_20210115003410_001_PLTHub_x64.log
MD5
e8b72b1935925833bd27433b7eab59e6

SHA1
a11667e40ce7e5beb6fe1d7d1acebca07a32d83e

SHA256
27f00ca6a9f58bc210923942bea1ae6caeef611b6c7eb779a66f0dbc73126f0e

SHA512
e1597fb124363c2e94c7ca5e15b45afb41f9d6614921d49f4603afa3d571d32a753301b9406a8ef73e326425ed616d76e1d2565413ff38aa22bc8e13f494ab4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{177F4689-8428-4F33-AA32-CEB37FA1968A}\.cr\PlantronicsHubInstaller.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{177F4689-8428-4F33-AA32-CEB37FA1968A}\.cr\PlantronicsHubInstaller.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.be\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.be\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\OldMHUUninstallerMSI
MD5
743b02346941048c8bcaf9f7860d4e15

SHA1
f65349e872b3a04911210ad45f858d6790b4e4fa

SHA256
128b3a697f85903eaa2c50d9ae8145235b6fa81114d0e94ce1936b7478bb67b5

SHA512
85bb907e164b7c5c118760edc7daedc21abd9310c930259a93af6a76aa333c4c8be49566ecb8a8c9a24e774523942afdf0c1488fad89fc3d175e4ea1b17598cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C41B7A53-9A30-4C51-8653-D2B3DBF274CB}\.cr\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C41B7A53-9A30-4C51-8653-D2B3DBF274CB}\.cr\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.be\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.be\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\OldMHUUninstaller
MD5
c6495e8916dfaf9e983ae41eea111798

SHA1
568c7e338d8bd9134d64c59aca8b96af303b141b

SHA256
326e19483f1ac92c92c750e23a94e9354cb8ae745e023c82990757ad88ed546c

SHA512
3d05199a2f74467a8fc46bb4df2983060aa0f92f89cb461d1c6c3e531ee4c2765a0edb5c6e4fa9263502c55fee73db96ffd9f7648020bb3275fa9b84540968f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\PLTHub_x64
MD5
33fdf4299d233d4ba3f1606b330763a9

SHA1
5f6f1384d99d81c96b1c45f74abdd01e55467d37

SHA256
68541542ba296691d6ed000874aeb05ffde170d096b31e516bf8d104fedccf88

SHA512
d67f7cfa2d5ab5afbaef3f4053c0c628bca0a69f582c8df27e18b5f2f082c052e961eb1ceef6830724521139fb536378d5f7f804ccb5a8d633c05e71d8b03b05

Download Submit
C:\Windows\Installer\MSI5831.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSI5A55.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSI5C3A.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSI6266.tmp
MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI6631.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSI66DE.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSI7602.tmp
MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI7AA7.tmp
MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
c1c95fd48e005e1dd69b5c899b1bcbfe

SHA1
1190d97cb281eaada6dea2b796d9109cdf7e558f

SHA256
517e448975b6865f51532a1dbdc4fb04c812f8cfbd27dc1287b176935445d5b8

SHA512
b69e3f0f3a79b158d314c464ff6ea39b1f6b4175c23547ded319e8a7abe56ea3380b471b3d0b5c3cf890f856dc2ee2995edb3bb7f335337445862cd5124ef521

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
1bed49318f93a591151f880527972e4b

SHA1
ecf4a345304b99e21506195c18bb3d52e5c91c38

SHA256
5eb0b0fed5f9b93995d4449d406aed38dff35236c68b3498e0b85e4e29d2b0c2

SHA512
41685175ebba1b0b072e742a079ba437228059818cf2a675b35beadb855d8445912972de9201567213df34ceb30faa67586cd027abbb16deadbb49e5cb64781b

Download Submit
C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_2b13d4544d6cf2e6\Calisto.cat
MD5
736da057af241071426d55704735a891

SHA1
1841be549d4092239b4ef9a1e16a9d8cd75ddf62

SHA256
caf830ff30e4111ab8ff7a36a94616ca0652a925c4d42dd0849a5cf4b9af06c9

SHA512
0caabdc08348cba5bd608bf306bb1b927a45d4839e7821a68c1f9d9b94a9796278617e8193cd7911ca374f71066117cc27dda215e2eb19c8f199c60100a14f8f

Download Submit
C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_2b13d4544d6cf2e6\calisto.inf
MD5
9265714b944e10c81e4e275c27fcda42

SHA1
07afe62d73c8799e9e5689f86fb9f48389717ba3

SHA256
c3a3ed0a5139517be14e7288f5132eeacf0286f2328b9966557132f2fee4c5ce

SHA512
d31e5eac98c4a60031b06d480695c1b233fbda7ed394d47eb75130da4546c42944d5b6660f4691ed0a6fc1a92ed6de9183f7e3dfe7f2fe537649bbe31b20841b

Download Submit
C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_08d1c611bc4d16da\PLTCSRBCxUSB.cat
MD5
1ecf9040bf85534dd573ed9e6c7764e0

SHA1
f0c54f542957e5d3b31b82e28edee76831e0af9f

SHA256
ea05b02b9caec0e653a8437e01b93f6684a8ee51c44e704cfec81bff1031557a

SHA512
bad890ad6b1848f94af240f59aa5743deb335b6a288622195bfd1e1e4addefc33135e1a4eb3217e5fdd4dc55479114bffe65ea206fd7f8a455d6ce126cc3ebe6

Download Submit
C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_08d1c611bc4d16da\PLTCSRBCxUSB.inf
MD5
c33678df9cdf9826e2301dbb526862be

SHA1
20c7eda3129b3ff8f72f9bf59252b718b554fbdc

SHA256
e730b076c3e90cfbc066117e84bcf21ccd44f5a17a1488cfc1b28eae6fbdd010

SHA512
9b17d7f2fe59161a4c6fa86b83e13988f19638bc39c0493cab653393ae1441d82210e9743b7bfa71dae51bb83c032b073691d83810f9500455f44ecc8ee84846

Download Submit
\Users\Admin\AppData\Local\Temp\{1A96D4C7-1D75-4F2A-9B83-38B8FA7F78F2}\.ba\wixstdba.dll
MD5
6ba2e331e0f447aaff0e8142df5f7230

SHA1
7a3f7fb93e7bdcf04fa83b50bde1d939b1864023

SHA256
58a135101a2044d96f470e29369a8214c5c2add774488d73c6ae81a588582239

SHA512
e137eb9f07e3b8ed03b309dd63e4fa9a4993e53b6d54c4c77ac289609811144fd66b49126b1168ebe8fa80669a765a51c1e72444d8c4deace091b65708d67d3b

Download Submit
\Users\Admin\AppData\Local\Temp\{F301E383-7CFF-48CA-9E06-B254AA99A0BF}\.ba\wixextba.dll
MD5
ea77fcd3a62ffb0433f353d006627ed1

SHA1
edd49f2a59307ac2fb511621f1052188dff74fc7

SHA256
ec415a95ed87c62b67566cae3c9dad2e0842238e39ffde8d168da98d9e7d7bb3

SHA512
c2d9cc51469e5cf1d8ead7ebdc59d6ce90c1b72939344e035a57b4977f4135a1a31313aa4a287c3150706ca6fdbcf7fede3b9c730a8d3a0be72189b8bdcca627

Download Submit
\Windows\Installer\MSI5831.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSI5A55.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSI5C3A.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSI6266.tmp
MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
\Windows\Installer\MSI6631.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSI66DE.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSI7602.tmp
MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
\Windows\Installer\MSI7AA7.tmp
MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
memory/192-75-0x0000000000000000-mapping.dmp

Download
memory/476-54-0x0000000000000000-mapping.dmp

Download
memory/1092-35-0x0000000000000000-mapping.dmp

Download
memory/2156-10-0x0000000000000000-mapping.dmp

Download
memory/2244-20-0x0000000000000000-mapping.dmp

Download
memory/2400-66-0x0000000000000000-mapping.dmp

Download
memory/2544-47-0x0000000000000000-mapping.dmp

Download
memory/2852-24-0x0000000000000000-mapping.dmp

Download
memory/3032-2-0x0000000000000000-mapping.dmp

Download
memory/3196-80-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3196-59-0x0000000000000000-mapping.dmp

Download
memory/3196-82-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3196-81-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3196-94-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3196-118-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3196-128-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3196-180-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3196-190-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/4404-62-0x0000000000000000-mapping.dmp

Download
memory/4692-31-0x0000000000000000-mapping.dmp

Download
memory/4724-18-0x0000000000000000-mapping.dmp

Download
memory/4764-29-0x0000000000000000-mapping.dmp

Download