File name:

pollev.exe

Full analysis: https://app.any.run/tasks/0af1733a-23a2-4aa1-a9df-96ce78fe53c1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 02, 2019, 22:50:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

0A391D65E128DC756E7F4BCD97CB034B

SHA1:

A28E854E8FC0DC2ED41C42BC7288444098D4C668

SHA256:

A1301B2FF552AA69DBCAB9A629907C1BBE59A0216585BDFBFC4B068D6B161894

SSDEEP:

24576:OBMEK+EmqH2liDcxzVGcTIjP8LK6/+u6X2JzIaPORYG:IMeNliyMcTIjaK6mFYzIo3G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • pollev.exe (PID: 392)
      • install.exe (PID: 4004)
      • pollev.exe (PID: 3468)
      • Setup.exe (PID: 3008)
      • addinutil.exe (PID: 1428)
      • POWERPNT.EXE (PID: 2152)
      • Validator.exe (PID: 3772)
      • pollev_browsers.exe (PID: 2896)
      • CefSharp.BrowserSubprocess.exe (PID: 836)
      • CefSharp.BrowserSubprocess.exe (PID: 1104)
      • CefSharp.BrowserSubprocess.exe (PID: 2452)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)
      • CefSharp.BrowserSubprocess.exe (PID: 3924)
      • CefSharp.BrowserSubprocess.exe (PID: 2064)

    • Changes settings of System certificates

      • pollev.exe (PID: 3468)
      • POWERPNT.EXE (PID: 2152)

    • Application was dropped or rewritten from another process

      • install.exe (PID: 4004)
      • Setup.exe (PID: 3008)
      • vstor40_x86.exe (PID: 2448)
      • Validator.exe (PID: 3772)
      • pollev_browsers.exe (PID: 2896)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)
      • CefSharp.BrowserSubprocess.exe (PID: 836)
      • CefSharp.BrowserSubprocess.exe (PID: 1104)
      • CefSharp.BrowserSubprocess.exe (PID: 2452)
      • CefSharp.BrowserSubprocess.exe (PID: 2064)
      • CefSharp.BrowserSubprocess.exe (PID: 3924)

    • Loads the Task Scheduler COM API

      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 3704)
      • ngen.exe (PID: 2308)
      • ngen.exe (PID: 3304)
      • ngen.exe (PID: 1524)
      • ngen.exe (PID: 2588)
      • ngen.exe (PID: 1780)
      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 1024)
      • ngen.exe (PID: 3384)
      • ngen.exe (PID: 2076)
      • ngen.exe (PID: 1972)
      • ngen.exe (PID: 920)
      • ngen.exe (PID: 3608)
      • ngen.exe (PID: 996)
      • ngen.exe (PID: 3996)
      • ngen.exe (PID: 2424)
      • ngen.exe (PID: 1788)
      • ngen.exe (PID: 2456)
      • ngen.exe (PID: 3448)
      • ngen.exe (PID: 1712)
      • ngen.exe (PID: 1252)
      • ngen.exe (PID: 3716)
      • ngen.exe (PID: 2564)
      • ngen.exe (PID: 1820)
      • ngen.exe (PID: 2244)
      • ngen.exe (PID: 3804)
      • ngen.exe (PID: 252)
      • ngen.exe (PID: 820)
      • ngen.exe (PID: 3104)
      • ngen.exe (PID: 2876)
      • ngen.exe (PID: 2436)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 1952)
      • ngen.exe (PID: 3772)
      • ngen.exe (PID: 2124)
      • ngen.exe (PID: 2300)
      • ngen.exe (PID: 2968)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 2640)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2276)
      • ngen.exe (PID: 2416)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 2692)
      • ngen.exe (PID: 2464)
      • ngen.exe (PID: 3924)
      • ngen.exe (PID: 3688)
      • ngen.exe (PID: 2752)
      • ngen.exe (PID: 3108)
      • ngen.exe (PID: 3556)
      • ngen.exe (PID: 2356)
      • ngen.exe (PID: 2384)
      • ngen.exe (PID: 2528)
      • ngen.exe (PID: 2492)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 3576)
      • ngen.exe (PID: 2548)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 3872)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2204)

    • Downloads executable files from the Internet

      • pollev.exe (PID: 3468)

    • Unusual execution from Microsoft Office

      • POWERPNT.EXE (PID: 2152)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pollev.exe (PID: 392)
      • pollev.exe (PID: 3468)
      • vstor40_x86.exe (PID: 2448)
      • vstor_redist.exe (PID: 912)
      • msiexec.exe (PID: 3992)

    • Application launched itself

      • pollev.exe (PID: 392)

    • Adds / modifies Windows certificates

      • pollev.exe (PID: 3468)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 3992)

    • Creates COM task schedule object

      • msiexec.exe (PID: 3992)

    • Creates files in the Windows directory

      • ngen.exe (PID: 1524)
      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 3704)
      • ngen.exe (PID: 2308)
      • ngen.exe (PID: 3304)
      • msiexec.exe (PID: 3992)
      • ngen.exe (PID: 1780)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 1024)
      • ngen.exe (PID: 3384)
      • ngen.exe (PID: 2076)
      • ngen.exe (PID: 1972)
      • ngen.exe (PID: 2588)
      • ngen.exe (PID: 3964)
      • ngen.exe (PID: 3608)
      • ngen.exe (PID: 996)
      • ngen.exe (PID: 3996)
      • ngen.exe (PID: 2424)
      • ngen.exe (PID: 1788)
      • ngen.exe (PID: 2456)
      • ngen.exe (PID: 3448)
      • ngen.exe (PID: 920)
      • ngen.exe (PID: 1712)
      • ngen.exe (PID: 1252)
      • ngen.exe (PID: 2564)
      • ngen.exe (PID: 1820)
      • ngen.exe (PID: 2244)
      • ngen.exe (PID: 252)
      • ngen.exe (PID: 820)
      • ngen.exe (PID: 3104)
      • ngen.exe (PID: 3716)
      • ngen.exe (PID: 2876)
      • ngen.exe (PID: 2436)
      • ngen.exe (PID: 3772)
      • ngen.exe (PID: 2124)
      • ngen.exe (PID: 3804)
      • ngen.exe (PID: 2300)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 1952)
      • ngen.exe (PID: 2968)
      • ngen.exe (PID: 3604)
      • ngen.exe (PID: 2208)
      • ngen.exe (PID: 2640)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2276)
      • ngen.exe (PID: 2416)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 2692)
      • ngen.exe (PID: 3688)
      • ngen.exe (PID: 3108)
      • ngen.exe (PID: 2752)
      • ngen.exe (PID: 3556)
      • ngen.exe (PID: 2356)
      • ngen.exe (PID: 3924)
      • ngen.exe (PID: 2384)
      • ngen.exe (PID: 2528)
      • ngen.exe (PID: 2464)
      • ngen.exe (PID: 3576)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 2548)
      • ngen.exe (PID: 2204)
      • ngen.exe (PID: 1792)
      • ngen.exe (PID: 2492)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 3872)

    • Removes files from Windows directory

      • msiexec.exe (PID: 3992)

    • Creates files in the program directory

      • pollev.exe (PID: 3468)

    • Starts Microsoft Installer

      • pollev.exe (PID: 3468)

    • Uses SYSTEMINFO.EXE to read environment

      • Validator.exe (PID: 3772)

    • Checks supported languages

      • POWERPNT.EXE (PID: 2152)

    • Reads Environment values

      • POWERPNT.EXE (PID: 2152)

    • Creates files in the user directory

      • msiexec.exe (PID: 3992)
      • MsiExec.exe (PID: 2704)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)
      • pollev_browsers.exe (PID: 2896)

    • Starts Internet Explorer

      • pollev_browsers.exe (PID: 2896)

  • INFO

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 3992)
      • MsiExec.exe (PID: 2676)
      • MsiExec.exe (PID: 4040)
      • MsiExec.exe (PID: 2704)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3992)

    • Application launched itself

      • msiexec.exe (PID: 3992)
      • iexplore.exe (PID: 3908)
      • iexplore.exe (PID: 1504)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3992)

    • Creates files in the program directory

      • msiexec.exe (PID: 3992)
      • MsiExec.exe (PID: 2704)

    • Reads Microsoft Office registry keys

      • Validator.exe (PID: 3772)
      • MsiExec.exe (PID: 2704)
      • POWERPNT.EXE (PID: 2152)

    • Manual execution by user

      • POWERPNT.EXE (PID: 2152)

    • Reads the hosts file

      • pollev_browsers.exe (PID: 2896)
      • CefSharp.BrowserSubprocess.exe (PID: 2600)

    • Changes internet zones settings

      • iexplore.exe (PID: 3908)
      • iexplore.exe (PID: 1504)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 1636)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 1636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 23:50:52+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2009 22:50:52
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Dec-2009 22:50:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005C4C
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.44011
.rdata
0x00007000
0x0000129C
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.04684
.data
0x00009000
0x00025C58
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.801
.ndata
0x0002F000
0x00018000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00047000
0x0001A958
0x0001AA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.40781

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22437
947
UNKNOWN
English - United States
RT_MANIFEST
2
2.73682
16936
UNKNOWN
English - United States
RT_ICON
3
2.88529
9640
UNKNOWN
English - United States
RT_ICON
4
3.5318
4264
UNKNOWN
English - United States
RT_ICON
5
7.72724
4098
UNKNOWN
English - United States
RT_ICON
6
5.19095
2440
UNKNOWN
English - United States
RT_ICON
7
5.60781
1128
UNKNOWN
English - United States
RT_ICON
103
2.86859
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
229
Monitored processes
97
Malicious processes
13
Suspicious processes
66

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start pollev.exe pollev.exe vstor_redist.exe setup.exe msiexec.exe vstor40_x86.exe install.exe no specs msiexec.exe no specs msiexec.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs addinutil.exe addinutil.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe validator.exe systeminfo.exe no specs powerpnt.exe pollev_browsers.exe cefsharp.browsersubprocess.exe cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe cefsharp.browsersubprocess.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "c:\Program Files\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
392"C:\Users\admin\Downloads\pollev.exe" C:\Users\admin\Downloads\pollev.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1223
Modules
Images
c:\users\admin\downloads\pollev.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
820c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
836"C:\Users\admin\AppData\Roaming\Microsoft\Addins\Poll Everywhere\PollEv Presenter\CefSharp.BrowserSubprocess.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\admin\AppData\Local\Temp\PollEvBrowserCore.log" --field-trial-handle=2124,8227284788745080451,5837604789057875225,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --lang=en-US --log-file="C:\Users\admin\AppData\Local\Temp\PollEvBrowserCore.log" --log-severity=error --user-agent="PollEvPresenter/2.12.2.0 Office/14.0 (Microsoft Windows 7 Professional Service Pack 1 6.1.7601.65536) CefSharp/75.1.142.0 Cef/r75.1.14+gc81164e+chromium-75.0.3770.100 Chromium/75.0.3770.100" --enable-system-flash=1 --cefsharpexitsub --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5286676664917097307 --renderer-client-id=3 --mojo-platform-channel-handle=2284 /prefetch:1 --wcf-enabled --host-process-id=2896C:\Users\admin\AppData\Roaming\Microsoft\Addins\Poll Everywhere\PollEv Presenter\CefSharp.BrowserSubprocess.exe—pollev_browsers.exe
User:
admin
Company:
The CefSharp Authors
Integrity Level:
MEDIUM
Description:
CefSharp.BrowserSubprocess
Exit code:
0
Version:
75.1.142.0
Modules
Images
c:\windows\system32\taskschd.dll
c:\windows\system32\cryptbase.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscorsvc.dll
c:\windows\microsoft.net\framework\v4.0.30319\clr.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msctf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
836c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
912"C:\Users\admin\AppData\Local\Temp\vstor_redist.exe" /q /norestartC:\Users\admin\AppData\Local\Temp\vstor_redist.exe
pollev.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual Studio Tools for Office Runtime 2010 Redistributable Setup
Exit code:
0
Version:
10.0.60724.00
Modules
Images
c:\users\admin\appdata\local\temp\vstor_redist.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
920c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
996c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
1024c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
1104"C:\Users\admin\AppData\Roaming\Microsoft\Addins\Poll Everywhere\PollEv Presenter\CefSharp.BrowserSubprocess.exe" --type=gpu-process --field-trial-handle=2124,8227284788745080451,5837604789057875225,131072 --disable-features=VizDisplayCompositor --no-sandbox --log-file="C:\Users\admin\AppData\Local\Temp\PollEvBrowserCore.log" --log-severity=error --user-agent="PollEvPresenter/2.12.2.0 Office/14.0 (Microsoft Windows 7 Professional Service Pack 1 6.1.7601.65536) CefSharp/75.1.142.0 Cef/r75.1.14+gc81164e+chromium-75.0.3770.100 Chromium/75.0.3770.100" --lang=en-US --cefsharpexitsub --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\admin\AppData\Local\Temp\PollEvBrowserCore.log" --service-request-channel-token=10388966426078901347 --mojo-platform-channel-handle=2288 /prefetch:2 --wcf-enabled --host-process-id=2896C:\Users\admin\AppData\Roaming\Microsoft\Addins\Poll Everywhere\PollEv Presenter\CefSharp.BrowserSubprocess.exe
pollev_browsers.exe
User:
admin
Company:
The CefSharp Authors
Integrity Level:
MEDIUM
Description:
CefSharp.BrowserSubprocess
Exit code:
4
Version:
75.1.142.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\addins\poll everywhere\pollev presenter\cefsharp.browsersubprocess.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
11 009
Read events
4 413
Write events
5 415
Delete events
1 181

Modification events

(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3468) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
448
Suspicious files
53
Text files
382
Unknown types
17

Dropped files

PID
Process
Filename
Type
3468pollev.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\vstor_redist[1].exe —
MD5:—
SHA256:—
3468pollev.exeC:\Users\admin\AppData\Local\Temp\vstor_redist.exe —
MD5:—
SHA256:—
392pollev.exeC:\Users\admin\AppData\Local\Temp\Validator.exeexecutable
MD5:—
SHA256:—
392pollev.exeC:\Users\admin\AppData\Local\Temp\PollEvWrapper.logtext
MD5:—
SHA256:—
3468pollev.exeC:\Users\admin\AppData\Local\Temp\PollEvWrapper.logtext
MD5:—
SHA256:—
3468pollev.exeC:\Users\admin\AppData\Local\Temp\Validator.exeexecutable
MD5:—
SHA256:—
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\modern-wizard.bmpimage
MD5:B5C688F14DA9AB1C9498FBD298CF5A59
SHA256:1447560773D1F992AC9AB1CC9DCC3B04A3DE24AC91F6816649143CFE46EFDC7D
3468pollev.exeC:\Users\admin\AppData\Local\Temp\nsrF2DC.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\AccessControl.dllexecutable
MD5:9E7D36EDCC188E166DEE9552017AC94F
SHA256:D52A83C2A8551CEBF48FF7A8D5930BE1873BCE990F855CCAB4D7479CFEB22E3D
392pollev.exeC:\Users\admin\AppData\Local\Temp\nsvE252.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
31
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2152
POWERPNT.EXE
GET
200
188.121.36.237:80
http://certificates.godaddy.com/repository/gdig2.crt
NL
der
1.21 Kb
whitelisted
2600
CefSharp.BrowserSubprocess.exe
GET
200
143.204.208.196:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
3992
msiexec.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt
US
der
969 b
whitelisted
3908
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3468
pollev.exe
GET
200
52.216.136.35:80
http://polleverywhere-app.s3.amazonaws.com/win-stable/PollEverywhere.PowerPointAddInSetup.msi
US
executable
62.6 Mb
shared
3992
msiexec.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3468
pollev.exe
2.18.233.19:443
download.microsoft.com
Akamai International B.V.
—
whitelisted
3468
pollev.exe
52.216.136.35:80
polleverywhere-app.s3.amazonaws.com
Amazon.com, Inc.
US
shared
2152
POWERPNT.EXE
188.121.36.237:80
certificates.godaddy.com
GoDaddy.com, LLC
NL
suspicious
3992
msiexec.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2600
CefSharp.BrowserSubprocess.exe
52.40.83.220:443
presenter.polleverywhere.com
Amazon.com, Inc.
US
unknown
2600
CefSharp.BrowserSubprocess.exe
13.35.254.158:443
d21m6t6okgl0h6.cloudfront.net
—
US
unknown
2600
CefSharp.BrowserSubprocess.exe
143.204.208.196:80
x.ss2.us
—
US
malicious
2600
CefSharp.BrowserSubprocess.exe
172.217.22.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2600
CefSharp.BrowserSubprocess.exe
104.17.64.4:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
2600
CefSharp.BrowserSubprocess.exe
172.217.22.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.microsoft.com
  • 2.18.233.19
whitelisted
polleverywhere-app.s3.amazonaws.com
  • 52.216.136.35
  • 52.216.84.72
shared
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
certificates.godaddy.com
  • 188.121.36.237
whitelisted
presenter.polleverywhere.com
  • 52.40.83.220
  • 54.71.2.191
  • 52.41.226.140
unknown
x.ss2.us
  • 143.204.208.196
  • 143.204.208.222
  • 143.204.208.228
  • 143.204.208.42
whitelisted
fonts.googleapis.com
  • 172.217.22.10
whitelisted
d21m6t6okgl0h6.cloudfront.net
  • 13.35.254.158
  • 13.35.254.123
  • 13.35.254.120
  • 13.35.254.57
whitelisted
cdnjs.cloudflare.com
  • 104.17.64.4
  • 104.17.65.4
whitelisted
www.polleverywhere.com
  • 35.164.99.112
  • 52.26.158.101
suspicious

Threats

PID
Process
Class
Message
3468
pollev.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3468
pollev.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
Process
Message
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pollev.exe