analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

pollev.exe

Full analysis: https://app.any.run/tasks/0af1733a-23a2-4aa1-a9df-96ce78fe53c1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 02, 2019, 22:50:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

0A391D65E128DC756E7F4BCD97CB034B

SHA1:

A28E854E8FC0DC2ED41C42BC7288444098D4C668

SHA256:

A1301B2FF552AA69DBCAB9A629907C1BBE59A0216585BDFBFC4B068D6B161894

SSDEEP:

24576:OBMEK+EmqH2liDcxzVGcTIjP8LK6/+u6X2JzIaPORYG:IMeNliyMcTIjaK6mFYzIo3G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • pollev.exe (PID: 3468)
      • pollev.exe (PID: 392)
      • Setup.exe (PID: 3008)
      • install.exe (PID: 4004)
      • addinutil.exe (PID: 1428)
      • pollev_browsers.exe (PID: 2896)
      • Validator.exe (PID: 3772)
      • POWERPNT.EXE (PID: 2152)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)
      • CefSharp.BrowserSubprocess.exe (PID: 836)
      • CefSharp.BrowserSubprocess.exe (PID: 2452)
      • CefSharp.BrowserSubprocess.exe (PID: 1104)
      • CefSharp.BrowserSubprocess.exe (PID: 2064)
      • CefSharp.BrowserSubprocess.exe (PID: 3924)

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 3008)
      • install.exe (PID: 4004)
      • vstor40_x86.exe (PID: 2448)
      • Validator.exe (PID: 3772)
      • pollev_browsers.exe (PID: 2896)
      • CefSharp.BrowserSubprocess.exe (PID: 836)
      • CefSharp.BrowserSubprocess.exe (PID: 2452)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)
      • CefSharp.BrowserSubprocess.exe (PID: 1104)
      • CefSharp.BrowserSubprocess.exe (PID: 3924)
      • CefSharp.BrowserSubprocess.exe (PID: 2064)

    • Changes settings of System certificates

      • pollev.exe (PID: 3468)
      • POWERPNT.EXE (PID: 2152)

    • Loads the Task Scheduler COM API

      • ngen.exe (PID: 3704)
      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 1524)
      • ngen.exe (PID: 2308)
      • ngen.exe (PID: 3304)
      • ngen.exe (PID: 2588)
      • ngen.exe (PID: 1780)
      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 1972)
      • ngen.exe (PID: 3384)
      • ngen.exe (PID: 1024)
      • ngen.exe (PID: 2076)
      • ngen.exe (PID: 920)
      • ngen.exe (PID: 1712)
      • ngen.exe (PID: 3608)
      • ngen.exe (PID: 3996)
      • ngen.exe (PID: 996)
      • ngen.exe (PID: 2424)
      • ngen.exe (PID: 3448)
      • ngen.exe (PID: 1252)
      • ngen.exe (PID: 2456)
      • ngen.exe (PID: 1788)
      • ngen.exe (PID: 820)
      • ngen.exe (PID: 3104)
      • ngen.exe (PID: 252)
      • ngen.exe (PID: 3804)
      • ngen.exe (PID: 3716)
      • ngen.exe (PID: 2564)
      • ngen.exe (PID: 1820)
      • ngen.exe (PID: 2244)
      • ngen.exe (PID: 2300)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 2124)
      • ngen.exe (PID: 3772)
      • ngen.exe (PID: 1952)
      • ngen.exe (PID: 2436)
      • ngen.exe (PID: 2876)
      • ngen.exe (PID: 2968)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 2640)
      • ngen.exe (PID: 2692)
      • ngen.exe (PID: 2416)
      • ngen.exe (PID: 2276)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 2464)
      • ngen.exe (PID: 3688)
      • ngen.exe (PID: 2752)
      • ngen.exe (PID: 3108)
      • ngen.exe (PID: 2356)
      • ngen.exe (PID: 2492)
      • ngen.exe (PID: 2384)
      • ngen.exe (PID: 3556)
      • ngen.exe (PID: 3924)
      • ngen.exe (PID: 2528)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 2548)
      • ngen.exe (PID: 3576)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 3872)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2204)

    • Unusual execution from Microsoft Office

      • POWERPNT.EXE (PID: 2152)

    • Downloads executable files from the Internet

      • pollev.exe (PID: 3468)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pollev.exe (PID: 392)
      • pollev.exe (PID: 3468)
      • vstor_redist.exe (PID: 912)
      • vstor40_x86.exe (PID: 2448)
      • msiexec.exe (PID: 3992)

    • Application launched itself

      • pollev.exe (PID: 392)

    • Adds / modifies Windows certificates

      • pollev.exe (PID: 3468)

    • Creates files in the Windows directory

      • ngen.exe (PID: 1524)
      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 2308)
      • ngen.exe (PID: 3704)
      • ngen.exe (PID: 2588)
      • ngen.exe (PID: 1780)
      • ngen.exe (PID: 3304)
      • ngen.exe (PID: 3964)
      • msiexec.exe (PID: 3992)
      • ngen.exe (PID: 1972)
      • ngen.exe (PID: 3384)
      • ngen.exe (PID: 1024)
      • ngen.exe (PID: 2076)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 920)
      • ngen.exe (PID: 996)
      • ngen.exe (PID: 1712)
      • ngen.exe (PID: 3608)
      • ngen.exe (PID: 3996)
      • ngen.exe (PID: 2424)
      • ngen.exe (PID: 1788)
      • ngen.exe (PID: 2456)
      • ngen.exe (PID: 3104)
      • ngen.exe (PID: 1252)
      • ngen.exe (PID: 3448)
      • ngen.exe (PID: 820)
      • ngen.exe (PID: 3716)
      • ngen.exe (PID: 252)
      • ngen.exe (PID: 2244)
      • ngen.exe (PID: 2876)
      • ngen.exe (PID: 3804)
      • ngen.exe (PID: 2300)
      • ngen.exe (PID: 1820)
      • ngen.exe (PID: 2564)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 2968)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 2124)
      • ngen.exe (PID: 1952)
      • ngen.exe (PID: 2436)
      • ngen.exe (PID: 3772)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 2640)
      • ngen.exe (PID: 2276)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2416)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 2464)
      • ngen.exe (PID: 2692)
      • ngen.exe (PID: 3688)
      • ngen.exe (PID: 3108)
      • ngen.exe (PID: 3556)
      • ngen.exe (PID: 2752)
      • ngen.exe (PID: 2384)
      • ngen.exe (PID: 2356)
      • ngen.exe (PID: 3924)
      • ngen.exe (PID: 2528)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 2492)
      • ngen.exe (PID: 2204)
      • ngen.exe (PID: 3872)
      • ngen.exe (PID: 2548)
      • ngen.exe (PID: 3576)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 1792)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 3992)

    • Creates COM task schedule object

      • msiexec.exe (PID: 3992)

    • Removes files from Windows directory

      • msiexec.exe (PID: 3992)

    • Creates files in the program directory

      • pollev.exe (PID: 3468)

    • Starts Microsoft Installer

      • pollev.exe (PID: 3468)

    • Reads Environment values

      • POWERPNT.EXE (PID: 2152)

    • Creates files in the user directory

      • MsiExec.exe (PID: 2704)
      • msiexec.exe (PID: 3992)
      • pollev_browsers.exe (PID: 2896)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)

    • Uses SYSTEMINFO.EXE to read environment

      • Validator.exe (PID: 3772)

    • Checks supported languages

      • POWERPNT.EXE (PID: 2152)

    • Starts Internet Explorer

      • pollev_browsers.exe (PID: 2896)

  • INFO

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 3992)
      • MsiExec.exe (PID: 2676)
      • MsiExec.exe (PID: 4040)
      • MsiExec.exe (PID: 2704)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3992)

    • Application launched itself

      • msiexec.exe (PID: 3992)
      • iexplore.exe (PID: 1504)
      • iexplore.exe (PID: 3908)

    • Creates files in the program directory

      • msiexec.exe (PID: 3992)
      • MsiExec.exe (PID: 2704)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3992)

    • Reads Microsoft Office registry keys

      • Validator.exe (PID: 3772)
      • MsiExec.exe (PID: 2704)
      • POWERPNT.EXE (PID: 2152)

    • Manual execution by user

      • POWERPNT.EXE (PID: 2152)

    • Reads the hosts file

      • pollev_browsers.exe (PID: 2896)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)

    • Changes internet zones settings

      • iexplore.exe (PID: 1504)
      • iexplore.exe (PID: 3908)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 1636)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 1636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x30fa
UninitializedDataSize: 1024
InitializedDataSize: 164864
CodeSize: 24064
LinkerVersion: 6
PEType: PE32
TimeStamp: 2009:12:05 23:50:52+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2009 22:50:52
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Dec-2009 22:50:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005C4C
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.44011
.rdata
0x00007000
0x0000129C
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.04684
.data
0x00009000
0x00025C58
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.801
.ndata
0x0002F000
0x00018000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00047000
0x0001A958
0x0001AA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.40781

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22437
947
UNKNOWN
English - United States
RT_MANIFEST
2
2.73682
16936
UNKNOWN
English - United States
RT_ICON
3
2.88529
9640
UNKNOWN
English - United States
RT_ICON
4
3.5318
4264
UNKNOWN
English - United States
RT_ICON
5
7.72724
4098
UNKNOWN
English - United States
RT_ICON
6
5.19095
2440
UNKNOWN
English - United States
RT_ICON
7
5.60781
1128
UNKNOWN
English - United States
RT_ICON
103
2.86859
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
229
Monitored processes
97
Malicious processes
13
Suspicious processes
66

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start pollev.exe pollev.exe vstor_redist.exe setup.exe msiexec.exe vstor40_x86.exe install.exe no specs msiexec.exe no specs msiexec.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs addinutil.exe addinutil.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe validator.exe systeminfo.exe no specs powerpnt.exe pollev_browsers.exe cefsharp.browsersubprocess.exe cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe cefsharp.browsersubprocess.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Users\admin\Downloads\pollev.exe" C:\Users\admin\Downloads\pollev.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1223
3468"C:\Users\admin\Downloads\pollev.exe" /UAC:2015C /NCRC C:\Users\admin\Downloads\pollev.exe
pollev.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1223
912"C:\Users\admin\AppData\Local\Temp\vstor_redist.exe" /q /norestartC:\Users\admin\AppData\Local\Temp\vstor_redist.exe
pollev.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual Studio Tools for Office Runtime 2010 Redistributable Setup
Exit code:
0
Version:
10.0.60724.00
3008c:\3eae84d09bc83c7a1ae0f843361870\Setup.exe /q /norestartc:\3eae84d09bc83c7a1ae0f843361870\Setup.exe
vstor_redist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
0
Version:
10.0.60724.0 built by: VSTO_Rel
3992C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2448vstor40_x86.exe /qc:\3eae84d09bc83c7a1ae0f843361870\vstor40\vstor40_x86.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Setup
Exit code:
0
Version:
10.0.60724.00
4004c:\c386bd55451fa7a8c9319018\install.exe /qc:\c386bd55451fa7a8c9319018\install.exe—vstor40_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
External Installer
Exit code:
0
Version:
10.0.60724.0 built by: VSTO_Rel
2676c:\Windows\system32\MsiExec.exe -Embedding AAC971A3D9243259D08174315429475Ec:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
4040c:\Windows\system32\MsiExec.exe -Embedding 0ED0E9CF2918CBDBF381D0A4B68E22C4 M Global\MSI0000c:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1524c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Total events
11 009
Read events
4 413
Write events
0
Delete events
0

Modification events

No data
Executable files
448
Suspicious files
53
Text files
382
Unknown types
17

Dropped files

PID
Process
Filename
Type
3468pollev.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\vstor_redist[1].exe —
MD5:—
SHA256:—
3468pollev.exeC:\Users\admin\AppData\Local\Temp\vstor_redist.exe —
MD5:—
SHA256:—
392pollev.exeC:\Users\admin\AppData\Local\Temp\PollEvWrapper.logtext
MD5:9977E735E625B82A9D3AAC5D6DEFB94F
SHA256:F3DC7754073A6901D63673C05D50942A8C3E1B3C2104F4BE4A13D7E7423C671B
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\version.dllexecutable
MD5:FBE588B15EB1BD86DEFADE69F796B56F
SHA256:31144E8B156FE87317073C48A09ABCB033FDA8DBDD96986C4ABEA8C00C00355F
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\AccessControl.dllexecutable
MD5:9E7D36EDCC188E166DEE9552017AC94F
SHA256:D52A83C2A8551CEBF48FF7A8D5930BE1873BCE990F855CCAB4D7479CFEB22E3D
3468pollev.exeC:\Users\admin\AppData\Local\Temp\Validator.exeexecutable
MD5:C6545F000CC1F76AE48C88D0D984A58D
SHA256:AE318028CA841DD52D1FBBA2A697FB2999C470B174CA2C707F66D3CC51607C60
392pollev.exeC:\Users\admin\AppData\Local\Temp\Validator.exeexecutable
MD5:C6545F000CC1F76AE48C88D0D984A58D
SHA256:AE318028CA841DD52D1FBBA2A697FB2999C470B174CA2C707F66D3CC51607C60
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\Install\screenie.bmpimage
MD5:FF4DCD5519DC6F41476329A082261BEF
SHA256:EB5DCDF32253AB85FBB52AABCE83450ADD3FEB462E1ABB584214ED4267C67169
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
31
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3468
pollev.exe
GET
200
52.216.136.35:80
http://polleverywhere-app.s3.amazonaws.com/win-stable/PollEverywhere.PowerPointAddInSetup.msi
US
executable
62.6 Mb
shared
2152
POWERPNT.EXE
GET
200
188.121.36.237:80
http://certificates.godaddy.com/repository/gdig2.crt
NL
der
1.21 Kb
whitelisted
2600
CefSharp.BrowserSubprocess.exe
GET
200
143.204.208.196:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
3908
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3992
msiexec.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.4 Kb
whitelisted
3992
msiexec.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt
US
der
969 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2600
CefSharp.BrowserSubprocess.exe
172.217.22.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2600
CefSharp.BrowserSubprocess.exe
172.217.22.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3992
msiexec.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3468
pollev.exe
2.18.233.19:443
download.microsoft.com
Akamai International B.V.
—
whitelisted
2152
POWERPNT.EXE
188.121.36.237:80
certificates.godaddy.com
GoDaddy.com, LLC
NL
suspicious
3468
pollev.exe
52.216.136.35:80
polleverywhere-app.s3.amazonaws.com
Amazon.com, Inc.
US
shared
2600
CefSharp.BrowserSubprocess.exe
52.40.83.220:443
presenter.polleverywhere.com
Amazon.com, Inc.
US
unknown
2600
CefSharp.BrowserSubprocess.exe
13.35.254.158:443
d21m6t6okgl0h6.cloudfront.net
—
US
unknown
2600
CefSharp.BrowserSubprocess.exe
104.17.64.4:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
2600
CefSharp.BrowserSubprocess.exe
35.164.99.112:443
www.polleverywhere.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
download.microsoft.com
  • 2.18.233.19
whitelisted
polleverywhere-app.s3.amazonaws.com
  • 52.216.136.35
  • 52.216.84.72
shared
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
certificates.godaddy.com
  • 188.121.36.237
whitelisted
presenter.polleverywhere.com
  • 52.40.83.220
  • 54.71.2.191
  • 52.41.226.140
unknown
x.ss2.us
  • 143.204.208.196
  • 143.204.208.222
  • 143.204.208.228
  • 143.204.208.42
whitelisted
fonts.googleapis.com
  • 172.217.22.10
whitelisted
d21m6t6okgl0h6.cloudfront.net
  • 13.35.254.158
  • 13.35.254.123
  • 13.35.254.120
  • 13.35.254.57
whitelisted
cdnjs.cloudflare.com
  • 104.17.64.4
  • 104.17.65.4
whitelisted
www.polleverywhere.com
  • 35.164.99.112
  • 52.26.158.101
suspicious

Threats

PID
Process
Class
Message
3468
pollev.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3468
pollev.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
Process
Message
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pollev.exe