ursnif_rm3 | hxxps://www[.]poly[.]com/in/en/support/downloads-apps

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
banker trojan ursnif_rm3

Executes dropped EXE 8 IoCs

Processes:

PlantronicsHubInstaller.exePlantronicsHubInstaller.exePlantronicsHubBootstrapper.exeOldMHUUninstaller.exeOldMHUUninstaller.exeOldMHUUninstaller.exeSpokesUpdateService.exePLTHub.exe

pid	process
2092	PlantronicsHubInstaller.exe
2116	PlantronicsHubInstaller.exe
2196	PlantronicsHubBootstrapper.exe
2272	OldMHUUninstaller.exe
2296	OldMHUUninstaller.exe
2368	OldMHUUninstaller.exe
844	SpokesUpdateService.exe
2288	PLTHub.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\OldMHUUninstallerMSI	office_xlm_macros

Loads dropped DLL 115 IoCs

Processes:

PlantronicsHubInstaller.exePlantronicsHubInstaller.exePlantronicsHubBootstrapper.exeOldMHUUninstaller.exeOldMHUUninstaller.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exePLTHub.exe

pid	process
2092	PlantronicsHubInstaller.exe
2116	PlantronicsHubInstaller.exe
2116	PlantronicsHubInstaller.exe
2196	PlantronicsHubBootstrapper.exe
2272	OldMHUUninstaller.exe
2296	OldMHUUninstaller.exe
2296	OldMHUUninstaller.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
3028	MsiExec.exe
2952	MsiExec.exe
1072	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
2952	MsiExec.exe
1072	MsiExec.exe
2952	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
1072	MsiExec.exe
3028	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2116	PlantronicsHubInstaller.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PlantronicsHubBootstrapper.exeOldMHUUninstaller.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	PlantronicsHubBootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c0ef003d-7840-4201-94f0-69a1aa26aa94} = "\"C:\\ProgramData\\Package Cache\\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\\PlantronicsHubBootstrapper.exe\" /burn.runonce"	PlantronicsHubBootstrapper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	OldMHUUninstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2895da4c-a4e1-44b8-b138-b34139f9acaa} = "\"C:\\ProgramData\\Package Cache\\{2895da4c-a4e1-44b8-b138-b34139f9acaa}\\OldMHUUninstaller.exe\" /burn.runonce"	OldMHUUninstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PLTHub.exe = "C:\\Program Files (x86)\\Plantronics\\Spokes3G\\PLTHub.exe -min"	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

PlantronicsHubInstaller.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PlantronicsHubInstaller.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

JavaScript code in executable 20 IoCs

Processes:

yara_rule
js
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe.f3ja950.partial	js
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe	js
\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe	js
\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe	js
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe	js
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe	js
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\PLTHub_x64	js
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\OldMHUUninstaller	js
C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe	js
\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe	js
\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe	js
\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe	js
C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe	js
C:\ProgramData\Package Cache\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\PlantronicsHubBootstrapper.exe	js

Drops file in System32 directory 35 IoCs

Processes:

DrvInst.exeDrvInst.exemsiexec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\csrbcx64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\SETF845.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}\SETFAE2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}\SETFAE2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}\SETFAE3.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\SETF844.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\SETF845.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_neutral_08d1c611bc4d16da\PLTCSRBCxUSB.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}\Calisto.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}\calisto.inf	DrvInst.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\PLTCSRBCxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\SETF855.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_neutral_08d1c611bc4d16da\pltcsrbcxusb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\SETF844.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\PLTCSRBCxUSB.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_neutral_2b13d4544d6cf2e6\calisto.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}\SETFAE3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pltcsrbcxusb.inf_amd64_neutral_08d1c611bc4d16da\pltcsrbcxusb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{06d65153-db98-445a-9f11-b00a1a12f637}	DrvInst.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{1349c98c-bc32-6539-4282-9e7c198cb469}\SETF855.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\calisto.inf_amd64_neutral_2b13d4544d6cf2e6\calisto.PNF	DrvInst.exe

Drops file in Program Files directory 126 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\cs.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\el.pak	msiexec.exe
File created	C:\Program Files (x86)\BroadSoft\Communicator\connectors\PlantronicsComPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\sw.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\cef_200_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\icudtl.dat	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\Calisto\calisto.cat	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsLync.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ta.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\nb.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\nl.pak	msiexec.exe
File opened for modification	C:\Program Files (x86)\Plantronics\Spokes3G\pltlocalcert.cer	MsiExec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\fa.pak	msiexec.exe
File created	C:\Program Files (x86)\BroadSoft\UC-One\connectors\PlantronicsUCPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pltlocalcert.cer	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ms.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\libcef.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\TestEngine.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\da.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\en-GB.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsNEC.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pshelp.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\pt-PT.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\vi.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\DSPTuningDFU.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\he.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\natives_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\DFUEngine.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pltlog4cpp.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\ring.wav	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\sv.pak	msiexec.exe
File created	C:\PROGRA~1\DIFX\4CBAA680AB78144E\DIFxAppA.dll	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Plantronics\Spokes3G\pltlocalcert.pem	MsiExec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsBroadsoftWeb.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\id.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\Plantronics.WMP.Plugin32.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\pltlocalcert.pem	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\zh-TW.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\CiscoInterface.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\es.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\hi.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\PenguinDFUDynamic.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsGenesys.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ru.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\CydoemusDFUDynamic.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\ml.pak	msiexec.exe
File created	C:\Program Files\Plantronics\Spokes3G\Plugins\Plantronics.WMP.Plugin64.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsJabber.dll	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\CSR\csrbcx86.sys	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsRest.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\gu.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\lt.pak	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsWMP.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\locales\sr.pak	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\CSR\csrbcx64.sys	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\CsrDfu.exe	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\PlantronicsCOM.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Devices\BTDeviceDFU.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\PlantronicsLync2013COM.exe	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsCitrix.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsSwyx.dll	msiexec.exe
File created	C:\Program Files (x86)\Plantronics\Spokes3G\Plugins\PlantronicsZoom.dll	msiexec.exe
File created	C:\Program Files\Common Files\Plantronics\CSR\PLTCSRBCxUSB.inf	msiexec.exe

Drops file in Windows directory 63 IoCs

Processes:

msiexec.exeMsiExec.exeDrvInst.exePlantronicsHubBootstrapper.exeDrvInst.exeDrvInst.exeOldMHUUninstaller.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\f75c8db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI143D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16CA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI173A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI147E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f75c8e2.ipi	msiexec.exe
File created	C:\Windows\Installer\f75c8e0.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1659.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	PlantronicsHubBootstrapper.exe
File opened for modification	C:\Windows\Installer\MSID937.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f75c8e0.msi	msiexec.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI741.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI145E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1689.tmp	msiexec.exe
File created	C:\Windows\Installer\f75c8e2.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\msvcp140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vcruntime140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA32.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\msvcp140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIDCF2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vccorlib140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vcruntime140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File created	C:\Windows\Installer\{EAFAA581-9A28-4E49-8767-D4DA2A7149E6}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	OldMHUUninstaller.exe
File opened for modification	C:\Windows\Installer\MSID678.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF15.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\concrt140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\concrt140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF14F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1618.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16B9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f75c8e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1639.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\185AAFAE82A994E478764DADA217946E\3.20.53033\vccorlib140.dll.3CFBED52_9B44_3A4D_953C_90E456671BA1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16A9.tmp	msiexec.exe
File created	C:\Windows\Installer\f75c8db.msi	msiexec.exe
File created	C:\Windows\Installer\f75c8dd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID58D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA64.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{EAFAA581-9A28-4E49-8767-D4DA2A7149E6}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI171A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSICB4D.tmp	msiexec.exe
File created	C:\Windows\Installer\f75c8df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f75c8dd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI149E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1709.tmp	msiexec.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c8431cd4d3ead601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 84 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "238"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "374"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDAE2D61-56C6-11EB-AE0F-E67B5CAEC115} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "238"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "209"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "327"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "330"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "106"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "281"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000ad19cd495be6f130a3c989cdedf1091741986fde9ff569afebdcfdd88b7e3a6e000000000e8000000002000020000000fd722149fd3d306642ef1d133e7a750de1fcb8d98614841ffc03e89c26eced1320000000beb34fb3f80a87e36920ce6c90732c83e8b1871de9ced63cb8c196a55f08ac8c40000000317aa96379902aef10958aa3d4f6fe65dfd24ad9525ba504c7c20779cd7878bf037644e1d155f48cb5b74f0ef3552b1ac0c3f832e31d905e03f42855a9374481	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "317434770"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "106"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "48"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "218"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "376"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004893c9d3ead601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "48"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "634"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "634"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "218"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "374"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "503"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000042d2f21f6f30cd8d8bf7716f007293aa3cf970643d954dc427a92363c4b0a4bd000000000e8000000002000020000000eb1eb02da4aa0c52dcb773537a6a75b75aaf8e47ed84d8b87e3e9b80fc0389ec900000005b82acd8fc2f0e96a17a5fe74a29b4f8f74e7fb41df6bbfade5a4f51accc95d3cd5263facc3a04e3ff8c04c573255c93d183177bb5b29ae86dc508f45daf3343448292129fab727cf0642563147a11a7863a7acfce0fa8a0452d856124f2c453e89962c380cb5fb78c4681a0827e482efea7fa94806d0217672624fda5c574695cfd919ba8ffc48bc6a3b31c732bf2fe40000000a1720cd2f94e43b292a4412719dcfa84a5e7bbbd93b2fa642e540d71e6b45d381260e5968d9773fff055e3cb4eb3273318325e92b5c234cff043626e0007fceb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\poly.com\Total = "223"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "376"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "374"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "503"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "503"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "48"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "106"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "223"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.poly.com\ = "238"	IEXPLORE.EXE

Modifies data under HKEY_USERS 143 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exemsiexec.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 1156 IoCs

Processes:

msiexec.exeOldMHUUninstaller.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{508CA8E3-1FC0-4871-AA8A-D0BDF17FD1E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{E4ED21AA-A29D-4128-A771-2722A658FA68}	OldMHUUninstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMStateDeviceEventArgs.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58E70C05-40D3-4361-93F4-C811581C00BA}\InprocServer32\ = "C:\\Program Files (x86)\\Plantronics\\PlantronicsCOM.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8E006D0-E578-4FC1-847A-5205E3AC58F0}\InprocServer32\ = "C:\\Program Files (x86)\\Plantronics\\PlantronicsCOM.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{96919E64-BDA0-4863-81C6-FBF66EFC16F3}\TypeLib\ = "{ECB9CBB5-7B1F-4DB7-8357-39B3B45BFFD3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8B85DBBB-1485-4F7A-9650-30D90A2C45EE}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{FA6EBD1E-05F4-4D1D-B25F-B63297319491}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMConversationDynamicsReportEventArgs.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1542F115-18B4-4970-8E69-F30DB83409C7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{A59046EA-5C54-4A9B-9EDF-1C18E92E92EC}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMBatteryLevelEventArgs\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1A51193-3BFD-4B0D-A4EA-29FE3F2BA7CD}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{FC6DA9A4-63CB-4861-A12B-2C2D48C61E5E}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{750B4A16-1338-4DB0-85BB-C6C89E4CB9AC}\LocalServer32\ = "C:\\Program Files (x86)\\Plantronics\\Spokes3G\\PLTHub.exe -min"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMContact	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMSessionManager\CurVer\ = "Plantronics.COMSessionManager.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87AA1CEB-3013-4249-8050-4CE19A216B39}\InprocServer32\ = "C:\\Program Files (x86)\\Plantronics\\PlantronicsCOM.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCallRequestEventArgs\CurVer\ = "Plantronics.COMCallRequestEventArgs.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{94660F69-7A31-476D-8F72-452F90FE4849}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{6EBB6E9D-6693-4F57-98EE-F5195E8FFA0B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87AA1CEB-3013-4249-8050-4CE19A216B39}\TypeLib\ = "{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B1A51193-3BFD-4B0D-A4EA-29FE3F2BA7CD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D74CDE86-9973-456A-91B0-FD438129F3A4}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMAALAcousticIncidentReportEventArgs\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{94660F69-7A31-476D-8F72-452F90FE4849}\ProgID\ = "Plantronics.COMAALAcousticIncidentReportEventArgs.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}\3.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\185AAFAE82A994E478764DADA217946E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMDeviceListener\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26529F95-873E-4F26-84A6-F42B46F8A672}\InprocServer32\ = "C:\\Program Files (x86)\\Plantronics\\PlantronicsCOM.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCallCommand.1\CLSID\ = "{77AD0CF3-B32B-4975-9E51-C4162C234BEC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMCallInfo.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BF644C11-DF4A-45F6-8FD2-8C9939228EEE}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CsrDfu.exe\AppID = "{1FFAEBA6-CFA3-4740-8705-51F7C943C345}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF740951-34C8-4E8A-BE93-62EFEF0E6152}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMSession.1\ = "COMSession Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMMobilePresenceEventArgs\CLSID\ = "{B1A51193-3BFD-4B0D-A4EA-29FE3F2BA7CD}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMCallManagerState.1\ = "COMCallManagerState Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF644C11-DF4A-45F6-8FD2-8C9939228EEE}\InprocServer32\ = "C:\\Program Files (x86)\\Plantronics\\PlantronicsCOM.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{59FF1D66-CE98-4060-9F6D-4037EC23D39A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{47392DD9-0FB9-45A3-B50E-D369AC5C7E41}\TypeLib\Version = "3.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52EB1EB4-6CF9-4675-9410-9508C3435807}\VersionIndependentProgID\ = "CsrDfu.Dfu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFE29ED7-0ACB-4D2E-9086-E6110C3D018B}\1.0\0\win32\ = "C:\\Program Files (x86)\\Plantronics\\Spokes3G\\Plugins\\SwyxPlugin.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA12DE4ED92A82147A1772226A85AF86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77AD0CF3-B32B-4975-9E51-C4162C234BEC}\VersionIndependentProgID\ = "Plantronics.COMCallCommand"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DECB63F9-CBBC-4930-969E-10BCD46E22C3}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{94660F69-7A31-476D-8F72-452F90FE4849}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CiscoInterface.PltHandset\CLSID\ = "{309910E1-E8F7-42D9-9101-6B1D73F8138C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1FE2761F-DABF-46A6-92A0-9FED3946BF51}\TypeLib\Version = "3.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{BA07181A-80C9-4844-A0AF-0CAB8CD70D1D}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}\3.0\ = "Plantronics Unified Runtime Engine SDK"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}\3.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{309910E1-E8F7-42D9-9101-6B1D73F8138C}\AppID = "{8B85DBBB-1485-4F7A-9650-30D90A2C45EE}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EBB6E9D-6693-4F57-98EE-F5195E8FFA0B}\ = "COMDeviceEventArgs Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87AA1CEB-3013-4249-8050-4CE19A216B39}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMAALTWAReportEventArgs.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{309910E1-E8F7-42D9-9101-6B1D73F8138C}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{5B6FFB4B-DE7D-4117-A851-389BA01A9AC9}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB2825B9-AA0C-4C96-9153-98CC7BE4701B}\TypeLib\ = "{69ED1B66-6D98-4C42-858E-7D8CB2728AB7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Plantronics.COMContact.1\CLSID\ = "{1F577A84-DA23-46EA-B5B4-156A446C368E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8E006D0-E578-4FC1-847A-5205E3AC58F0}\ProgID\ = "Plantronics.COMCallRequestEventArgs.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Plantronics.COMHostCommand.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E7842AE-253A-40B7-9DBF-1247CC292EF8}\ = "ICOMCallEvents"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC3910A4-3167-461A-9851-28414570CB97}\Version\ = "1.0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 172 IoCs

Processes:

msiexec.exeMsiExec.exe

pid	process
2740	msiexec.exe
2740	msiexec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe
2952	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 316 IoCs

Processes:

vssvc.exeDrvInst.exeOldMHUUninstaller.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	2460	vssvc.exe
Token: SeRestorePrivilege	2460	vssvc.exe
Token: SeAuditPrivilege	2460	vssvc.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeRestorePrivilege	2628	DrvInst.exe
Token: SeLoadDriverPrivilege	2628	DrvInst.exe
Token: SeLoadDriverPrivilege	2628	DrvInst.exe
Token: SeLoadDriverPrivilege	2628	DrvInst.exe
Token: SeShutdownPrivilege	2368	OldMHUUninstaller.exe
Token: SeIncreaseQuotaPrivilege	2368	OldMHUUninstaller.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeSecurityPrivilege	2740	msiexec.exe
Token: SeCreateTokenPrivilege	2368	OldMHUUninstaller.exe
Token: SeAssignPrimaryTokenPrivilege	2368	OldMHUUninstaller.exe
Token: SeLockMemoryPrivilege	2368	OldMHUUninstaller.exe
Token: SeIncreaseQuotaPrivilege	2368	OldMHUUninstaller.exe
Token: SeMachineAccountPrivilege	2368	OldMHUUninstaller.exe
Token: SeTcbPrivilege	2368	OldMHUUninstaller.exe
Token: SeSecurityPrivilege	2368	OldMHUUninstaller.exe
Token: SeTakeOwnershipPrivilege	2368	OldMHUUninstaller.exe
Token: SeLoadDriverPrivilege	2368	OldMHUUninstaller.exe
Token: SeSystemProfilePrivilege	2368	OldMHUUninstaller.exe
Token: SeSystemtimePrivilege	2368	OldMHUUninstaller.exe
Token: SeProfSingleProcessPrivilege	2368	OldMHUUninstaller.exe
Token: SeIncBasePriorityPrivilege	2368	OldMHUUninstaller.exe
Token: SeCreatePagefilePrivilege	2368	OldMHUUninstaller.exe
Token: SeCreatePermanentPrivilege	2368	OldMHUUninstaller.exe
Token: SeBackupPrivilege	2368	OldMHUUninstaller.exe
Token: SeRestorePrivilege	2368	OldMHUUninstaller.exe
Token: SeShutdownPrivilege	2368	OldMHUUninstaller.exe
Token: SeDebugPrivilege	2368	OldMHUUninstaller.exe
Token: SeAuditPrivilege	2368	OldMHUUninstaller.exe
Token: SeSystemEnvironmentPrivilege	2368	OldMHUUninstaller.exe
Token: SeChangeNotifyPrivilege	2368	OldMHUUninstaller.exe
Token: SeRemoteShutdownPrivilege	2368	OldMHUUninstaller.exe
Token: SeUndockPrivilege	2368	OldMHUUninstaller.exe
Token: SeSyncAgentPrivilege	2368	OldMHUUninstaller.exe
Token: SeEnableDelegationPrivilege	2368	OldMHUUninstaller.exe
Token: SeManageVolumePrivilege	2368	OldMHUUninstaller.exe
Token: SeImpersonatePrivilege	2368	OldMHUUninstaller.exe
Token: SeCreateGlobalPrivilege	2368	OldMHUUninstaller.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe
Token: SeTakeOwnershipPrivilege	2740	msiexec.exe
Token: SeRestorePrivilege	2740	msiexec.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

iexplore.exePlantronicsHubInstaller.exePLTHub.exe

pid	process
2024	iexplore.exe
2024	iexplore.exe
2116	PlantronicsHubInstaller.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

PLTHub.exe

pid process

2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe
2288 PLTHub.exe

pid	process
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe
2288	PLTHub.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2024	iexplore.exe
2024	iexplore.exe
1896	IEXPLORE.EXE
1896	IEXPLORE.EXE
1896	IEXPLORE.EXE
1896	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1896	IEXPLORE.EXE
1896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 78 IoCs

Processes:

iexplore.exePlantronicsHubInstaller.exePlantronicsHubInstaller.exePlantronicsHubBootstrapper.exeOldMHUUninstaller.exeOldMHUUninstaller.exemsiexec.exe

description	pid	process	target process
PID 2024 wrote to memory of 1896	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1896	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1896	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1896	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1468	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1468	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1468	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1468	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2024 wrote to memory of 2092	2024	iexplore.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2092 wrote to memory of 2116	2092	PlantronicsHubInstaller.exe	PlantronicsHubInstaller.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2116 wrote to memory of 2196	2116	PlantronicsHubInstaller.exe	PlantronicsHubBootstrapper.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2196 wrote to memory of 2272	2196	PlantronicsHubBootstrapper.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2272 wrote to memory of 2296	2272	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2296 wrote to memory of 2368	2296	OldMHUUninstaller.exe	OldMHUUninstaller.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 2952	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 3028	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 3028	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 3028	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 3028	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 3028	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 1072	2740	msiexec.exe	MsiExec.exe
PID 2740 wrote to memory of 1072	2740	msiexec.exe	MsiExec.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.poly.com/in/en/support/downloads-apps
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1896

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:2307080 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe" -q -burn.elevated BurnPipe.{385B6554-1493-4DF8-9458-849DA2B2DBEF} {9E3B9C6E-AA39-430D-AD10-964FDA7895CC} 2116
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2196

C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe
"C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe" /install /quiet
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe" -burn.clean.room="C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296

C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe" -q -burn.elevated BurnPipe.{79A85C02-D8E9-4432-B899-69C81E84CFF3} {DA2AB08F-45DA-48DE-84CB-FA4623EFFB99} 2296
7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files (x86)\Plantronics\Spokes3G\PLTHub.exe
"C:\Program Files (x86)\Plantronics\Spokes3G\PLTHub.exe" -setfocus
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2288

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "000000000000056C" "00000000000003E8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ADE95329E1A3D9FC7686DE99B64C3C24
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2952

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding CC39DC86C01BC443C9F118DC3387FC85
2⤵
- Loads dropped DLL
PID:3028

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 858D674D8C2203A00F8FF317D490C0AA M Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:1072

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding C7FC00274657748FC2DF2CB2CFA2A8CF M Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1556

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3430c2a7-8edc-0748-4a42-2d09bc82e655}\PLTCSRBCxUSB.inf" "9" "6ba8011f3" "0000000000000550" "WinSta0\Default" "00000000000003B0" "208" "C:\Program Files\Common Files\Plantronics\CSR"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1228

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{00d9866a-4925-4d7f-649b-291bf4a9df17}\calisto.inf" "9" "6c8c6ef9b" "00000000000003B0" "WinSta0\Default" "00000000000003E8" "208" "C:\Program Files\Common Files\Plantronics\Calisto"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2128

C:\Program Files (x86)\Plantronics\Spokes3G\SpokesUpdateService.exe
"C:\Program Files (x86)\Plantronics\Spokes3G\SpokesUpdateService.exe" install
1⤵
- Executes dropped EXE
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\COMMON~1\PLANTR~1\CSR\csrbcx64.sys
MD5
c72d445d22c23a14b8b97e36699c22ae

SHA1
03b9c0284aa58c7b4631241b121bd43a36ce57b0

SHA256
d4940968abdbd714f3b98f395a9746d8fc0bd2b322b5eee6dd9ad791ff63bd54

SHA512
33b6cfc04c99517d019f292ba6da7b6904e0b5ab6ebc317606f28c916400f46a103bfc70a843a3c6b9f9ad1b58c5198697ad7641ca531d8fd901fa66ddb286df

Download Submit
C:\Program Files\Common Files\Plantronics\CSR\PLTCSRBCxUSB.cat
MD5
1ecf9040bf85534dd573ed9e6c7764e0

SHA1
f0c54f542957e5d3b31b82e28edee76831e0af9f

SHA256
ea05b02b9caec0e653a8437e01b93f6684a8ee51c44e704cfec81bff1031557a

SHA512
bad890ad6b1848f94af240f59aa5743deb335b6a288622195bfd1e1e4addefc33135e1a4eb3217e5fdd4dc55479114bffe65ea206fd7f8a455d6ce126cc3ebe6

Download Submit
C:\Program Files\Common Files\Plantronics\CSR\PLTCSRBCxUSB.inf
MD5
c33678df9cdf9826e2301dbb526862be

SHA1
20c7eda3129b3ff8f72f9bf59252b718b554fbdc

SHA256
e730b076c3e90cfbc066117e84bcf21ccd44f5a17a1488cfc1b28eae6fbdd010

SHA512
9b17d7f2fe59161a4c6fa86b83e13988f19638bc39c0493cab653393ae1441d82210e9743b7bfa71dae51bb83c032b073691d83810f9500455f44ecc8ee84846

Download Submit
C:\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe
MD5
c6495e8916dfaf9e983ae41eea111798

SHA1
568c7e338d8bd9134d64c59aca8b96af303b141b

SHA256
326e19483f1ac92c92c750e23a94e9354cb8ae745e023c82990757ad88ed546c

SHA512
3d05199a2f74467a8fc46bb4df2983060aa0f92f89cb461d1c6c3e531ee4c2765a0edb5c6e4fa9263502c55fee73db96ffd9f7648020bb3275fa9b84540968f2

Download Submit
C:\ProgramData\Package Cache\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\ProgramData\Package Cache\{c0ef003d-7840-4201-94f0-69a1aa26aa94}\state.rsm
MD5
0dab4773c081a46ffe180afa07940258

SHA1
2b37d7036ed2c170dfcafd8651e3f155dd8ed107

SHA256
51b19686dc0110b9a23afd77395eb3cc2e3c81f19d7661f250d873bd10d34878

SHA512
e97af8e3fda56c0819c196b9f05caebae177affd237abcb10434a6c76525b39a62556ea2e56373db78e7cd08b8cce1c3bf19d46c9e2cfc851a1b887b6ca5c425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
MD5
bc94d23c9480a35facb5e50f2ab187ef

SHA1
7b677b8bc9704f369818ba9aaa86786c3735a602

SHA256
69e4bd5ed06087fbf1faaa02a868325de2da88a33516e285389de9ecfdb2543a

SHA512
40c607b9fbaae5ebf899b7b6bd90db649968526b91353e30ee32d28aa02107bf8b10eb1aa56e8859764c235227b2ded7b8b8f013ad72bcab86b7b52c3769675f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
0e7dd6f8883353918beab32df55a60ba

SHA1
df1d32b1478c2d9227d4964ca3a90217fd935daf

SHA256
fc0551d582084a0182a186afcae6e57638beb8386f0387d754123b4760015a1e

SHA512
e1532fe62eabd5df4af700bda9276040583af158db580e013a7fb8bbc551bf6ee0622874641cb960ddf129cb4eaa85520a81920608554c1c315d9b5464291070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
MD5
f0453022a3c4c7d62cba34ba5cea4c45

SHA1
35255f85ad99b7f033c40f1534c3c20bf7088f84

SHA256
bd62715094d50faf9134c39476dc4dcfc4231c254e152538e3661be17f93bba5

SHA512
60a6450748acda2f9dee36285ee8e2fca37d45e0b6edc06855ddc1f0d22b5f199f3d9d24a391af117c592065d6fe2ad7f5c713561b1ad1016dfa37d18826844a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_2B287B23632C44FDB851E8157EDB328B
MD5
40e755c183b3114c0053640ab8114fc0

SHA1
ddf9ae3e3c1c5a97c2126a9deac9ca7228b3f2c4

SHA256
d6c8d2049084db07944b384e995c3e3e902094ea6f0da5a32b67a9bb7aac590d

SHA512
9607a153e39b92088f3b3650f2de45342eec7f48f87f33a49f702a3d9ccd326b5afa40ac47b4c6fc50ffc0fb5b838ba660ba67ce777f40cdd131b62982a72848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
MD5
13ff593431ceef5606c3fbe0036e9e37

SHA1
155ff489290bdba7a4e5b050b798c42f68ed5d65

SHA256
a89243dbbbacfae5c32142cfac729b92fa4d0c1bba1c1a4a615943f319461472

SHA512
3143b898890b5bd36b322fa36463a3428d50462e5f3e3b22556274823beae8a1c8a1f7f862df3157e847e18542a93151cd74d5a81935df9a9c812e4e9df73c89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
MD5
93005c9296d85520d93c3cbe647cdbfd

SHA1
bd0fc6000b263418fd58d4afecdd70b302fced47

SHA256
f4b694894fa0acec5a933f4a5a530b029ea7562b4b84522b4d0eae78a9bf2159

SHA512
79e0ab7468965715bc31c3678c0fee74d1f7b34a5d6487455704dca9bea156a9d11abef322c46777b03ee0d7690021b29f069fbfcc94cad1de5c1da4ad48b96f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
1b9b09deb326ee4011734c4a71927e17

SHA1
9c89e1ab0e477e9ca6a1376494a4087a1a8a6ee5

SHA256
15b1ba5ef7232cc1b1bee28adb5729ec2297410e5613b6ec994fc9a99a06c978

SHA512
c546cbf8078e041ef070c297e267534e52f593b611f4732f33eee431a3730a5db5fde3f1d608bcc8047370ef424dc9e88ffb84d02a50fde90fcf620cd9c9c627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
b6e5acca4f42fcc657e76778d18a1f5a

SHA1
c8fb2a17589fbf70bb8d3b8771e45485d266ae0a

SHA256
6c654f40fca4da05687a7c9a620b3f7d7f212122a43cc477024ec398c8a25409

SHA512
e48a24eef1a9133d4d59cf14705694419fbf16f7a0cd0eeb05edafdad2a7c742d63d8c0c904e931236ada4e6438a2e20f1fc5efb0ac8b4b299970e990d0b6457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
0c56bdc3d933c2ff063993bafac4f14d

SHA1
e9e40caf588e36d13ff21749755f6906bd4d51d3

SHA256
edd20132e81c044c8fcf183ef8fd8b8bef7e31798b436c0d890c66baed5f5453

SHA512
f2e53c61b83cb8cdaf59db251e5d70b66e93f5aa940233a3fa6127dfcc1db64e7f4a5347ba0a004ef2f28ea8c4145a5bc734de3f8fe125beb9b6c2ec5292bcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
MD5
fa0485162e3719c19761040b838afaf8

SHA1
dc768c87438b688276d9527643d6076bd8d2eace

SHA256
036ec2faf1e49d9fa4307ed18b19bb6535e089bfe42b3428aa292fb8c2434eb0

SHA512
7f5001d4db73e6a03b425cba46ac0e1696342c0bef786444c4ff3d9323a7261ffc15d2ccc7599cbdf03408e295794bf920fee4fb18d5ee2f0b0464f18173debc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_2B287B23632C44FDB851E8157EDB328B
MD5
d7f569ddb8f59835c35c4dd06983424d

SHA1
845bb55b529fb14c3371d9ff1d29c33b408dd37b

SHA256
24c51cebdf338c11c734f40c10aaa74da42c760935adc86e946854cdc4f532d8

SHA512
81c43453fd8665912c36a8b88f703aba73978ec232e0e4c21275ed283f90904fc58b9699ceca71f90262f86b580604cdc0f8fba563056266264610fd012ae869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
e83cdca00621599406c14e85264493fd

SHA1
23c075667acd24cd4dd4abc9ff75d96667c067ec

SHA256
e4768115e96432de9c58784559b6985242917f86e3735199b604b874f520b453

SHA512
b0e6129a510c2fbdf64206647e4a765343bbed5936e3971a20c7ea875d7ef79276cee8d876666b6cc3185c64ffc92a76143f4a689fe7bd665424d3a9d31945e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LCE6GMF4\www.poly[1].xml
MD5
094aa9e93a95c5d533d570f13cde94a7

SHA1
744c53971571e2283d694756f203cee141199762

SHA256
73f824090b0dceb1015aefe291129c092d95d648ed3b1cae4eeca0ffb5f99906

SHA512
8e1e1e443260013c2c2aa53d93a18df7cae87bf1e8472353d116a605f5fd809340f350747f95f3c317b0683cba087fb2a88b6d4ca327c1cc17736649347fbc4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
3496cad43365618d7119f4316c412021

SHA1
7d598aefe6a28d503ae0b3c63e3dbbf28bfc3a77

SHA256
aebd76a10f004636de3dc81e0cf74f6c2cc78bfcfdd10a3fa374302a0f7d8759

SHA512
f7efe77c8c240ee490ee6ba981313b9aae57c15e7fe8d843edef656f6e4a8d25c598efa3973f8c5171c384a50a5010f3c320b4c2c8c2ab7ec9119d48153a6250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe
MD5
1d9055556bc6054a8f73f2c3d348dd43

SHA1
f61afe22302ccb74b7a2a132e8d677eec289618d

SHA256
47f2f959582a2c63790d7997ba4ce9da283f97976260fe505a8d33e9f047e175

SHA512
a38d6e10cb6fede8e88a4c0459a84a9de29cf3afc670cafe99857818c8dcfbc364e718d53e7ba108d1f1d2c2515beb36db1044305b4643760b3e3a6841b3e929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5T8OP4KT\PlantronicsHubInstaller.exe.f3ja950.partial
MD5
1d9055556bc6054a8f73f2c3d348dd43

SHA1
f61afe22302ccb74b7a2a132e8d677eec289618d

SHA256
47f2f959582a2c63790d7997ba4ce9da283f97976260fe505a8d33e9f047e175

SHA512
a38d6e10cb6fede8e88a4c0459a84a9de29cf3afc670cafe99857818c8dcfbc364e718d53e7ba108d1f1d2c2515beb36db1044305b4643760b3e3a6841b3e929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D73194RS\favicon[1].ico
MD5
40a201409447501ac66a05435036b3c8

SHA1
1847e797eab6c9d43e75c41893276655f730f068

SHA256
1ed60b2cbb603f4b4d9b90fd73360826be48fd13ce2d30731ae2baafb73dc91f

SHA512
7c720719a484a7d059fa3ce5b57a3dff187484c6901ebd7853b94eae6694e314ed681bb4895ddb6663e40c003fc4d619e1d9385ef871d40bf5e0be2811e2e033

Download Submit
C:\Users\Admin\AppData\Local\Temp\OldMHUUninstaller_20210115001815_000_OldMHUUninstallerMSI.log
MD5
518c9f38a6c0c5ce167d18ea46fa1106

SHA1
2bbb5b8b34c9f06033366e6b0799bb50b004759e

SHA256
b2deb5eb5b15459d33a9dba1517047de2684daa0d54d9426dfd5b83eda9ba0c5

SHA512
3d9a9a1827dfc9850f4ec779eb95473a5b75449a5dca7e90ceffb2e4db72e0d9eb165051ba5940beb8b249374e1f4feb333cb2ec358e695b6d6d36dc87991a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plantronics_Hub_Software_20210115001750_001_PLTHub_x64.log
MD5
2cb22eb3d0d450159dc4214da4671b9e

SHA1
91a5a50ce44d2d9ce114fb4e6dc37fdf070a43e2

SHA256
ff7ae08058bc70b62c610cba20bdc70877d04c216a9acdf7c99e23b88391ed15

SHA512
d62557d06027b29b7947297fda263acee5c7118e99575c2c8b2242b875cfe50e5d801d723f0ffa9ae885633616605a65e8ffc5b941607695bba7586f842d3558

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\OldMHUUninstaller
MD5
c6495e8916dfaf9e983ae41eea111798

SHA1
568c7e338d8bd9134d64c59aca8b96af303b141b

SHA256
326e19483f1ac92c92c750e23a94e9354cb8ae745e023c82990757ad88ed546c

SHA512
3d05199a2f74467a8fc46bb4df2983060aa0f92f89cb461d1c6c3e531ee4c2765a0edb5c6e4fa9263502c55fee73db96ffd9f7648020bb3275fa9b84540968f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\PLTHub_x64
MD5
33fdf4299d233d4ba3f1606b330763a9

SHA1
5f6f1384d99d81c96b1c45f74abdd01e55467d37

SHA256
68541542ba296691d6ed000874aeb05ffde170d096b31e516bf8d104fedccf88

SHA512
d67f7cfa2d5ab5afbaef3f4053c0c628bca0a69f582c8df27e18b5f2f082c052e961eb1ceef6830724521139fb536378d5f7f804ccb5a8d633c05e71d8b03b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\OldMHUUninstallerMSI
MD5
743b02346941048c8bcaf9f7860d4e15

SHA1
f65349e872b3a04911210ad45f858d6790b4e4fa

SHA256
128b3a697f85903eaa2c50d9ae8145235b6fa81114d0e94ce1936b7478bb67b5

SHA512
85bb907e164b7c5c118760edc7daedc21abd9310c930259a93af6a76aa333c4c8be49566ecb8a8c9a24e774523942afdf0c1488fad89fc3d175e4ea1b17598cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8RGIG6NM.txt
MD5
4c77af88ef294098c1c6ecb5e4d5a8d0

SHA1
fe153cd83965be2a04c4c22017db147c23a60516

SHA256
0c26edcfd28e118e347aa181e4bafbe023b46fe0e2d9b115368858e85d1b6702

SHA512
174a6a427f934ba55bc2fa391ba1f52bcbce0c5f4974a3b6ed14f0bfd89eda57f9bc15df719aa0d6960afca6ba6689ad77cfc04442a49f894c8b5ab358e0d384

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DFR83M7E.txt
MD5
c37a087bf1782caeee028971dd2634af

SHA1
0edb8c39e3cd647811a9dc72cf2a0e898437a76a

SHA256
6be979fe1b743b99aabb9aa81ad987f1672ef9fbcbd11529392a682530856fab

SHA512
757f89cb9c2bdaec355571ebdbbdd996e67e7a733c6d255ea4d262311e54d736334f76b18bec4d4fe41e6877bc40727e304abcc7fcbd859666f529aab1cc4c91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EW47R7Z6.txt
MD5
664490241663869f0b2bb1d05237ec8c

SHA1
ee0d985cb45efac2bf870f340033b280284f0404

SHA256
819af4678dac883eb86a29cce2002100912c8e74f1abe43ac3041d9957b6e89b

SHA512
a80f4a2d75c58f8bb43d6f4c5d74482a6e136b58819fd1f696402d4e4df86b5a88311c458077a5d2ed0ac4d06531efda4353b86ce24fd2ffbda7328ddc54ae7d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\P7799P8S.txt
MD5
093bb5da4169cee5bd8d252c15ee7e9f

SHA1
af3980f7f4e3488983db3c15af4b1c19b00353fc

SHA256
3adc747318d40ba2ec12b1187499cdafcf1f2bc450a76b61d0def33cc5a68fe8

SHA512
4dff4d1739d74dea2f0f4f5da2f527ccc6937fc9e673020963bd2b0cd73b1e124b2cd3faff8bfe0ed9947378c068e67b2b964bb24c82407803b9a08bbc60898e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RATCF0RF.txt
MD5
6034ee46ffc79d73ac6116588dbf7bbb

SHA1
c3fa874db6c9a40ac5af3a96ce8091bd484554b6

SHA256
0df792481f08b0d7bb299f8dc754c91b0a2c996042adc5090347833dbaf2dba0

SHA512
2f21e3ed658bad91a5c2b6dc377afc1c152b5ca08eb553f4ad1433c462db726bb58b8e3e82a2235e7a274a639f155f9bdb73d9d2eb76129c256401485063a770

Download Submit
C:\Windows\Installer\MSID2CE.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSID58D.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSID678.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSIDA32.tmp
MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSIDCF2.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSIDF15.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
C:\Windows\Installer\MSIF14F.tmp
MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\WindowsUpdate.log
MD5
b2f53e8ed44193e57920d2fdd50c8698

SHA1
27e38f36d9384b02f865c7cbcc1c5c589d49428f

SHA256
0d954639e740eeb11d5a25ef76213754f285718ff3d74df89033b341245559fb

SHA512
3b95922277fa7352786ffef34d3a80bb62d69dfc17b0281e94bb74613066e97b1c2e07f3a96da0b187e82a67d1139c79ce721aafbd6aeb7cfbaaebf479c0e74d

Download Submit
\ProgramData\Package Cache\568C7E338D8BD9134D64C59ACA8B96AF303B141B\OldMHUUninstaller.exe
MD5
c6495e8916dfaf9e983ae41eea111798

SHA1
568c7e338d8bd9134d64c59aca8b96af303b141b

SHA256
326e19483f1ac92c92c750e23a94e9354cb8ae745e023c82990757ad88ed546c

SHA512
3d05199a2f74467a8fc46bb4df2983060aa0f92f89cb461d1c6c3e531ee4c2765a0edb5c6e4fa9263502c55fee73db96ffd9f7648020bb3275fa9b84540968f2

Download Submit
\Users\Admin\AppData\Local\Temp\{1318D589-C426-49DA-8A3B-7C5EC011BA50}\.cr\PlantronicsHubInstaller.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
\Users\Admin\AppData\Local\Temp\{7FF659C4-F6C1-4110-9C8F-D381924B8B37}\.cr\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.ba\wixextba.dll
MD5
ea77fcd3a62ffb0433f353d006627ed1

SHA1
edd49f2a59307ac2fb511621f1052188dff74fc7

SHA256
ec415a95ed87c62b67566cae3c9dad2e0842238e39ffde8d168da98d9e7d7bb3

SHA512
c2d9cc51469e5cf1d8ead7ebdc59d6ce90c1b72939344e035a57b4977f4135a1a31313aa4a287c3150706ca6fdbcf7fede3b9c730a8d3a0be72189b8bdcca627

Download Submit
\Users\Admin\AppData\Local\Temp\{A1962986-104F-4029-922C-E7A8DF8A96D4}\.be\PlantronicsHubBootstrapper.exe
MD5
8d1434864e8f0a79fc7bfd65c5ef17b3

SHA1
b910ca7fd9c6b4d26d1eeba46f7fc881e78942e4

SHA256
25cba281db9fc9d78ea9f62c7d3b99b59600d77f1068a01bc296d889b20f786a

SHA512
055d362905eaf116301cdd9d6d73d8ecb7e3befddf34a4d7c6cf0540f4801d26fd305658e00c13ac6d6f1985d2c4bb4b7d3b5b6271c96efc0ea16b1ee7b66af7

Download Submit
\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.ba\wixstdba.dll
MD5
6ba2e331e0f447aaff0e8142df5f7230

SHA1
7a3f7fb93e7bdcf04fa83b50bde1d939b1864023

SHA256
58a135101a2044d96f470e29369a8214c5c2add774488d73c6ae81a588582239

SHA512
e137eb9f07e3b8ed03b309dd63e4fa9a4993e53b6d54c4c77ac289609811144fd66b49126b1168ebe8fa80669a765a51c1e72444d8c4deace091b65708d67d3b

Download Submit
\Users\Admin\AppData\Local\Temp\{A266F7F2-FE16-4EE3-9BBF-2B3776F56F24}\.be\OldMHUUninstaller.exe
MD5
ec285724976065140339a3aeb262d2d2

SHA1
80ef67bf1c2bc7d99bfc46fbc726ee6aaefc1bcd

SHA256
84e9dc28191e76661355a3d421fe70808011c727d50c84dc36d6ee05eeeda3ae

SHA512
5511d003da7adb174620da912da72e63305916709b314ff24a470efea64e4d7960360cac9debb31d327b4dc9e00c9b3aeb2cb23fe40fbf86f51da4d3cf44dec7

Download Submit
\Windows\Installer\MSID2CE.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSID58D.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSID678.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSIDA32.tmp
MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
\Windows\Installer\MSIDCF2.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSIDF15.tmp
MD5
d9b6f0ecaed59bb359843e28a9e4340e

SHA1
dab11372346d7666b18fcd78d4131c1c1a1ca78a

SHA256
fafa969670287ff5fb4df8d58718b8c0a06f933e3447b957a672251b19bca53e

SHA512
759fcb6305d63889b80a1595f6dbc37c535693e6a80372d775df69f72035414ad4f180de3b3f13120db23a622176f2a164dbac2eb5271e1c3060de739adf2953

Download Submit
\Windows\Installer\MSIF14F.tmp
MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
memory/1072-83-0x0000000002940000-0x0000000002951000-memory.dmp

Filesize
68KB

Download
memory/1072-305-0x0000000002610000-0x0000000002614000-memory.dmp

Filesize
16KB

Download
memory/1072-304-0x0000000002610000-0x0000000002614000-memory.dmp

Filesize
16KB

Download
memory/1072-73-0x0000000000000000-mapping.dmp

Download
memory/1072-84-0x0000000002530000-0x0000000002541000-memory.dmp

Filesize
68KB

Download
memory/1072-82-0x0000000002530000-0x0000000002541000-memory.dmp

Filesize
68KB

Download
memory/1448-2-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmp

Filesize
2.5MB

Download
memory/1468-5-0x0000000000000000-mapping.dmp

Download
memory/1556-76-0x0000000000000000-mapping.dmp

Download
memory/1896-3-0x0000000000000000-mapping.dmp

Download
memory/2092-22-0x0000000000000000-mapping.dmp

Download
memory/2116-25-0x0000000000000000-mapping.dmp

Download
memory/2196-30-0x0000000000000000-mapping.dmp

Download
memory/2272-36-0x0000000000000000-mapping.dmp

Download
memory/2288-306-0x0000000000000000-mapping.dmp

Download
memory/2296-39-0x0000000000000000-mapping.dmp

Download
memory/2296-43-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/2368-47-0x0000000000000000-mapping.dmp

Download
memory/2952-61-0x0000000000000000-mapping.dmp

Download
memory/3028-68-0x0000000000000000-mapping.dmp

Download