File name:

pollev.exe

Full analysis: https://app.any.run/tasks/3bcb6dbf-3210-4448-a483-603cf1149b2e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 22, 2018, 18:46:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

EF8FAB37B4D632E1A81123AAEEE31C49

SHA1:

ECA335894249C0222E6BC6448E7265C075C00B8D

SHA256:

F4836AF192D6541AEBACDE8574DAA1A90D1F6E45463A3C689ED17FDB827FF7C2

SSDEEP:

12288:9t2bVsEKD5oGMExg1g8cMfcKAZY8QYcThXJo4dRYw:9wSEK+EmqZDQYahXJTRYw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application loaded dropped or rewritten executable

      • pollev.exe (PID: 2880)
      • pollev.exe (PID: 2692)
      • Setup.exe (PID: 2996)
      • addinutil.exe (PID: 2532)
      • install.exe (PID: 3556)

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 2996)
      • install.exe (PID: 3556)
      • Validator.exe (PID: 2820)
      • vstor40_x86.exe (PID: 2584)
      • Validator.exe (PID: 2940)

    • Loads the Task Scheduler COM API

      • ngen.exe (PID: 3640)
      • ngen.exe (PID: 3456)
      • ngen.exe (PID: 3240)
      • ngen.exe (PID: 3692)
      • ngen.exe (PID: 2372)
      • ngen.exe (PID: 2756)
      • ngen.exe (PID: 3220)
      • ngen.exe (PID: 2408)
      • ngen.exe (PID: 3724)
      • ngen.exe (PID: 3376)
      • ngen.exe (PID: 2872)
      • ngen.exe (PID: 3740)
      • ngen.exe (PID: 4032)
      • ngen.exe (PID: 2492)
      • ngen.exe (PID: 3988)
      • ngen.exe (PID: 2264)
      • ngen.exe (PID: 3084)
      • ngen.exe (PID: 3528)
      • ngen.exe (PID: 2464)
      • ngen.exe (PID: 3956)
      • ngen.exe (PID: 3456)
      • ngen.exe (PID: 2320)
      • ngen.exe (PID: 3756)
      • ngen.exe (PID: 2912)
      • ngen.exe (PID: 4068)
      • ngen.exe (PID: 3352)
      • ngen.exe (PID: 2520)
      • ngen.exe (PID: 2456)
      • ngen.exe (PID: 3096)
      • ngen.exe (PID: 2532)
      • ngen.exe (PID: 2792)
      • ngen.exe (PID: 3592)
      • ngen.exe (PID: 3984)
      • ngen.exe (PID: 3276)
      • ngen.exe (PID: 2108)
      • ngen.exe (PID: 2900)
      • ngen.exe (PID: 2912)
      • ngen.exe (PID: 4044)
      • ngen.exe (PID: 2536)
      • ngen.exe (PID: 2448)
      • ngen.exe (PID: 2520)
      • ngen.exe (PID: 3180)
      • ngen.exe (PID: 2480)
      • ngen.exe (PID: 3884)
      • ngen.exe (PID: 2800)
      • ngen.exe (PID: 3232)
      • ngen.exe (PID: 3780)
      • ngen.exe (PID: 3740)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 3596)
      • ngen.exe (PID: 3724)
      • ngen.exe (PID: 4032)
      • ngen.exe (PID: 3120)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 4024)
      • ngen.exe (PID: 2784)
      • ngen.exe (PID: 2656)
      • ngen.exe (PID: 2332)
      • ngen.exe (PID: 2792)
      • ngen.exe (PID: 3492)
      • ngen.exe (PID: 3852)
      • ngen.exe (PID: 2220)
      • ngen.exe (PID: 3644)
      • ngen.exe (PID: 2288)
      • software_reporter_tool.exe (PID: 3988)

    • Changes settings of System certificates

      • TrustedInstaller.exe (PID: 4008)

  • SUSPICIOUS

    • Application launched itself

      • pollev.exe (PID: 2880)
      • software_reporter_tool.exe (PID: 3988)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 3356)

    • Creates COM task schedule object

      • msiexec.exe (PID: 3356)

    • Creates files in the Windows directory

      • ngen.exe (PID: 3640)
      • msiexec.exe (PID: 3356)
      • ngen.exe (PID: 3456)
      • ngen.exe (PID: 3240)
      • ngen.exe (PID: 2372)
      • ngen.exe (PID: 3692)
      • ngen.exe (PID: 2756)
      • ngen.exe (PID: 3988)
      • ngen.exe (PID: 3220)
      • ngen.exe (PID: 2408)
      • ngen.exe (PID: 3724)
      • ngen.exe (PID: 2872)
      • ngen.exe (PID: 4032)
      • ngen.exe (PID: 3376)
      • ngen.exe (PID: 2492)
      • ngen.exe (PID: 2264)
      • ngen.exe (PID: 3528)
      • ngen.exe (PID: 2464)
      • ngen.exe (PID: 3956)
      • ngen.exe (PID: 3456)
      • ngen.exe (PID: 2320)
      • ngen.exe (PID: 3756)
      • ngen.exe (PID: 2912)
      • ngen.exe (PID: 3084)
      • ngen.exe (PID: 3740)
      • ngen.exe (PID: 3352)
      • ngen.exe (PID: 2520)
      • ngen.exe (PID: 3984)
      • ngen.exe (PID: 2456)
      • ngen.exe (PID: 3096)
      • ngen.exe (PID: 2532)
      • ngen.exe (PID: 3592)
      • ngen.exe (PID: 2792)
      • ngen.exe (PID: 3276)
      • ngen.exe (PID: 4068)
      • ngen.exe (PID: 2108)
      • ngen.exe (PID: 2536)
      • ngen.exe (PID: 2912)
      • ngen.exe (PID: 2448)
      • ngen.exe (PID: 4044)
      • ngen.exe (PID: 2900)
      • ngen.exe (PID: 2520)
      • ngen.exe (PID: 3180)
      • ngen.exe (PID: 2480)
      • ngen.exe (PID: 3884)
      • ngen.exe (PID: 2800)
      • ngen.exe (PID: 4032)
      • ngen.exe (PID: 3780)
      • ngen.exe (PID: 3740)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 3596)
      • ngen.exe (PID: 3232)
      • ngen.exe (PID: 3120)
      • ngen.exe (PID: 4024)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 2656)
      • ngen.exe (PID: 2784)
      • ngen.exe (PID: 2792)
      • ngen.exe (PID: 2332)
      • ngen.exe (PID: 3724)
      • ngen.exe (PID: 3492)
      • ngen.exe (PID: 3852)
      • ngen.exe (PID: 2220)
      • ngen.exe (PID: 3644)
      • ngen.exe (PID: 2288)
      • TrustedInstaller.exe (PID: 4008)

    • Removes files from Windows directory

      • msiexec.exe (PID: 3356)

    • Creates files in the program directory

      • pollev.exe (PID: 2692)

    • Creates files in the user directory

      • msiexec.exe (PID: 3356)
      • MsiExec.exe (PID: 3624)

    • Adds / modifies Windows certificates

      • TrustedInstaller.exe (PID: 4008)

  • INFO

    • Loads rich edit control libraries

      • pollev.exe (PID: 2880)
      • pollev.exe (PID: 2692)

    • Dropped object may contain URL's

      • pollev.exe (PID: 2692)
      • pollev.exe (PID: 2880)
      • Setup.exe (PID: 2996)
      • vstor40_x86.exe (PID: 2584)
      • ngen.exe (PID: 3640)
      • ngen.exe (PID: 3240)
      • ngen.exe (PID: 3692)
      • ngen.exe (PID: 2372)
      • ngen.exe (PID: 2756)
      • vstor_redist.exe (PID: 2352)
      • msiexec.exe (PID: 3356)
      • ngen.exe (PID: 3988)
      • ngen.exe (PID: 3220)
      • ngen.exe (PID: 2900)
      • ngen.exe (PID: 4044)
      • ngen.exe (PID: 2536)
      • ngen.exe (PID: 2520)
      • ngen.exe (PID: 2912)
      • ngen.exe (PID: 2448)
      • ngen.exe (PID: 3180)
      • ngen.exe (PID: 2480)
      • ngen.exe (PID: 3884)
      • ngen.exe (PID: 3232)
      • ngen.exe (PID: 3120)
      • ngen.exe (PID: 3596)
      • ngen.exe (PID: 3780)
      • ngen.exe (PID: 3740)
      • ngen.exe (PID: 2788)
      • ngen.exe (PID: 2800)
      • ngen.exe (PID: 4032)
      • ngen.exe (PID: 3724)
      • ngen.exe (PID: 4024)
      • ngen.exe (PID: 2792)
      • ngen.exe (PID: 2256)
      • ngen.exe (PID: 2656)
      • ngen.exe (PID: 2784)
      • ngen.exe (PID: 2332)
      • ngen.exe (PID: 3492)
      • ngen.exe (PID: 3852)
      • ngen.exe (PID: 2220)
      • ngen.exe (PID: 3644)
      • ngen.exe (PID: 2288)
      • MsiExec.exe (PID: 3624)
      • Validator.exe (PID: 2820)
      • msiexec.exe (PID: 2632)
      • install.exe (PID: 3556)
      • Validator.exe (PID: 2940)

    • Creates files in the program directory

      • msiexec.exe (PID: 3356)
      • MsiExec.exe (PID: 3624)

    • Application loaded dropped or rewritten executable

      • msiexec.exe (PID: 3356)
      • MsiExec.exe (PID: 516)
      • MsiExec.exe (PID: 668)
      • MsiExec.exe (PID: 3624)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3356)

    • Application launched itself

      • msiexec.exe (PID: 3356)
      • chrome.exe (PID: 3584)

    • Creates or modifies windows services

      • msiexec.exe (PID: 3356)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3356)

    • Loads the .NET runtime environment

      • addinutil.exe (PID: 2532)
      • addinutil.exe (PID: 3212)
      • MsiExec.exe (PID: 3624)
      • Validator.exe (PID: 2820)
      • Validator.exe (PID: 2940)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 3356)
      • install.exe (PID: 3556)

    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 3624)
      • Validator.exe (PID: 2820)

    • Changes settings of System certificates

      • chrome.exe (PID: 3584)

    • Adds / modifies Windows certificates

      • chrome.exe (PID: 3584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 23:50:52+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2009 22:50:52
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Dec-2009 22:50:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005C4C
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.44011
.rdata
0x00007000
0x0000129C
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.04684
.data
0x00009000
0x00025C58
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.801
.ndata
0x0002F000
0x00018000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00047000
0x0001A958
0x0001AA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.40781

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22437
947
UNKNOWN
English - United States
RT_MANIFEST
2
2.73682
16936
UNKNOWN
English - United States
RT_ICON
3
2.88529
9640
UNKNOWN
English - United States
RT_ICON
4
3.5318
4264
UNKNOWN
English - United States
RT_ICON
5
7.72724
4098
UNKNOWN
English - United States
RT_ICON
6
5.19095
2440
UNKNOWN
English - United States
RT_ICON
7
5.60781
1128
UNKNOWN
English - United States
RT_ICON
103
2.86859
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
228
Monitored processes
96
Malicious processes
6
Suspicious processes
66

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start pollev.exe pollev.exe vstor_redist.exe setup.exe msiexec.exe vstor40_x86.exe install.exe no specs msiexec.exe no specs msiexec.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs addinutil.exe addinutil.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe validator.exe systeminfo.exe no specs trustedinstaller.exe no specs validator.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs software_reporter_tool.exe no specs software_reporter_tool.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516c:\Windows\system32\MsiExec.exe -Embedding A056C4158196D4DC01A75322CF3EB424 M Global\MSI0000c:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
668c:\Windows\system32\MsiExec.exe -Embedding E157A4D0C75212DEAD710EB6B2BBDB42c:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f207d7c,0x6f207da4,0x6f207d8cC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1124c:\windows\system32\msiexec.exe /qn /x {C5408BCB-F83C-48D3-8D1C-4ACBD238B6FB} /lv+ C:\Users\admin\AppData\Local\Temp\PollEvMsi.logc:\windows\system32\msiexec.exe—pollev.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1605
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1420msiexec.exe /qn /x "{6FDC250C-160D-4EC6-B93F-E54986D2D95E}" /lv+ C:\Users\admin\AppData\Local\Temp\PollEvMsi.logC:\Windows\system32\msiexec.exe—pollev.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
1605
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1840"c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=23.129.0 --initial-client-data=0xe4,0xec,0xf0,0xe8,0xf4,0x14cc42c,0x14cc43c,0x14cc44cc:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe—software_reporter_tool.exe
User:
admin
Company:
Google
Integrity Level:
HIGH
Description:
Software Reporter Tool
Exit code:
0
Version:
23.129.0
Modules
Images
c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
2108c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
2220c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
2256c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
2264c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesc:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
Total events
7 748
Read events
2 763
Write events
4 828
Delete events
157

Modification events

(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2692) pollev.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pollev_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
397
Suspicious files
33
Text files
260
Unknown types
11

Dropped files

PID
Process
Filename
Type
2692pollev.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GZH9GIXH\vstor_redist[1].exe —
MD5:—
SHA256:—
2692pollev.exeC:\Users\admin\AppData\Local\Temp\vstor_redist.exe —
MD5:—
SHA256:—
2880pollev.exeC:\Users\admin\AppData\Local\Temp\Validator.exeexecutable
MD5:—
SHA256:—
2880pollev.exeC:\Users\admin\AppData\Local\Temp\PollEvWrapper.logtext
MD5:—
SHA256:—
2692pollev.exeC:\Users\admin\AppData\Local\Temp\PollEvWrapper.logtext
MD5:—
SHA256:—
2692pollev.exeC:\Users\admin\AppData\Local\Temp\Validator.exeexecutable
MD5:—
SHA256:—
2880pollev.exeC:\Users\admin\AppData\Local\Temp\nsvC60A.tmp\modern-wizard.bmpimage
MD5:B5C688F14DA9AB1C9498FBD298CF5A59
SHA256:1447560773D1F992AC9AB1CC9DCC3B04A3DE24AC91F6816649143CFE46EFDC7D
2880pollev.exeC:\Users\admin\AppData\Local\Temp\nsvC60A.tmp\version.dllexecutable
MD5:FBE588B15EB1BD86DEFADE69F796B56F
SHA256:31144E8B156FE87317073C48A09ABCB033FDA8DBDD96986C4ABEA8C00C00355F
2880pollev.exeC:\Users\admin\AppData\Local\Temp\nsvC60A.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
2880pollev.exeC:\Users\admin\AppData\Local\Temp\nsvC60A.tmp\AccessControl.dllexecutable
MD5:9E7D36EDCC188E166DEE9552017AC94F
SHA256:D52A83C2A8551CEBF48FF7A8D5930BE1873BCE990F855CCAB4D7479CFEB22E3D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
26
DNS requests
23
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
52.7 Kb
whitelisted
—
—
GET
200
52.216.96.83:80
http://polleverywhere-app.s3.amazonaws.com/win-stable/PollEverywhere.PowerPointAddInSetup.msi
US
executable
37.6 Mb
shared
—
—
GET
200
188.121.36.239:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
NL
der
1.69 Kb
whitelisted
—
—
GET
200
188.121.36.239:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCA2y8FtcMTMu
NL
der
1.73 Kb
whitelisted
—
—
GET
200
92.123.92.234:80
http://download.microsoft.com/download/9/4/9/949B0B7C-6385-4664-8EA8-3F6038172322/vstor_redist.exe
unknown
executable
38.1 Mb
whitelisted
—
—
GET
200
172.217.22.110:80
http://clients1.google.com/tools/pso/ping?as=chrome&brand=GCEA&pid=&hl=en&rep=2&rlz=C1:1C1GCEA_enDE765UA770,C2:1C2GCEA_enDE765,C7:1C7GCEA_enDE765
US
text
124 b
whitelisted
—
—
GET
200
2.21.246.17:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
AT
der
781 b
whitelisted
—
—
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E.crt
US
der
993 b
whitelisted
—
—
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt
US
der
969 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
95.172.94.44:443
secure.quantserve.com
Quantcast Corporation
GB
unknown
—
—
216.58.210.8:443
www.googletagmanager.com
Google Inc.
US
whitelisted
—
—
204.79.197.200:443
bat.bing.com
Microsoft Corporation
US
whitelisted
—
—
92.123.92.234:80
download.microsoft.com
Akamai International B.V.
—
whitelisted
—
—
2.21.246.17:80
crl.microsoft.com
Akamai International B.V.
AT
whitelisted
—
—
52.216.96.83:80
polleverywhere-app.s3.amazonaws.com
Amazon.com, Inc.
US
shared
—
—
188.121.36.239:80
ocsp.godaddy.com
GoDaddy.com, LLC
NL
unknown
—
—
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
34.212.189.16:443
production-cutlass.polleverywhere.com
Amazon.com, Inc.
US
unknown
—
—
172.217.18.162:443
www.googleadservices.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.microsoft.com
  • 92.123.92.234
whitelisted
crl.microsoft.com
  • 2.21.246.17
  • 2.21.246.10
whitelisted
polleverywhere-app.s3.amazonaws.com
  • 52.216.96.83
shared
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.godaddy.com
  • 188.121.36.239
whitelisted
production-cutlass.polleverywhere.com
  • 34.212.189.16
  • 52.24.189.244
unknown
clientservices.googleapis.com
  • 216.58.207.35
whitelisted
polleverywhere.com
  • 54.69.43.238
  • 54.148.11.23
suspicious
www.polleverywhere.com
  • 54.148.11.23
  • 54.69.43.238
suspicious
d20idoa067r6h3.cloudfront.net
  • 54.192.98.194
  • 54.192.98.104
  • 54.192.98.119
  • 54.192.98.15
  • 54.192.98.151
  • 54.192.98.122
  • 54.192.98.153
  • 54.192.98.219
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
A Network Trojan was detected
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
Process
Message
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pollev.exe