File name:

PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com.zip

Full analysis: https://app.any.run/tasks/175a19da-1d1d-4a5e-a937-d7c8dd79fd5d
Verdict: Malicious activity
Analysis date: December 10, 2024, 05:56:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

607D1C28D4F92293207C764B850001D2

SHA1:

65593E15F5D4279F4FE2BE8B2C4D43CDA751BA9A

SHA256:

A52A59A1480DA1ACF0CFA8268831F99CF4F7CEE2A15FED6B957F3D13064D6E17

SSDEEP:

98304:YUlQtgZrJ68V6QFZnF10fr3SC4Tb1oZf+lmtvtX21kl0dKuHwdWtdnlqqdPoQs4O:yzsMMvgror2W9SDSLdqdhP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6564)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6564)
      • installpolyboard.exe (PID: 6908)

    • Process drops legitimate windows executable

      • installpolyboard.exe (PID: 6908)

    • Executable content was dropped or overwritten

      • installpolyboard.exe (PID: 6908)

    • Searches for installed software

      • dllhost.exe (PID: 6992)
      • Polyboard.exe (PID: 5092)
      • Polyboard.exe (PID: 6296)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7036)

    • Checks Windows Trust Settings

      • installpolyboard.exe (PID: 6908)

    • Creates a software uninstall entry

      • installpolyboard.exe (PID: 6908)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6564)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6564)

    • Checks supported languages

      • installpolyboard.exe (PID: 6908)
      • Polyboard.exe (PID: 6296)
      • Polyboard.exe (PID: 5092)

    • Creates files in the program directory

      • installpolyboard.exe (PID: 6908)

    • Sends debugging messages

      • installpolyboard.exe (PID: 6908)

    • Create files in a temporary directory

      • installpolyboard.exe (PID: 6908)
      • Polyboard.exe (PID: 5092)

    • Reads the computer name

      • installpolyboard.exe (PID: 6908)

    • Manages system restore points

      • SrTasks.exe (PID: 6304)

    • Reads the machine GUID from the registry

      • installpolyboard.exe (PID: 6908)

    • Reads the software policy settings

      • installpolyboard.exe (PID: 6908)

    • Manual execution by a user

      • Polyboard.exe (PID: 5092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2017:03:11 13:45:40
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe installpolyboard.exe no specs installpolyboard.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs polyboard.exe no specs polyboard.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3544\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5092"C:\Program Files (x86)\Boole & Partners\PolyBoard 6\Polyboard.exe" C:\Program Files (x86)\Boole & Partners\PolyBoard 6\Polyboard.exe—explorer.exe
User:
admin
Company:
Boole & Partners
Integrity Level:
MEDIUM
Description:
PolyBoard
Version:
6.4.10.1
Modules
Images
c:\program files (x86)\boole & partners\polyboard 6\polyboard.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6296"C:\Program Files (x86)\Boole & Partners\PolyBoard 6\Polyboard.exe" /Register /BackgroundC:\Program Files (x86)\Boole & Partners\PolyBoard 6\Polyboard.exe—installpolyboard.exe
User:
admin
Company:
Boole & Partners
Integrity Level:
HIGH
Description:
PolyBoard
Exit code:
4294967286
Version:
6.4.10.1
Modules
Images
c:\program files (x86)\boole & partners\polyboard 6\polyboard.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6304C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6564"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6856"C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.1258\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com\installpolyboard.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.1258\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com\installpolyboard.exe—WinRAR.exe
User:
admin
Company:
Boole & Partners
Integrity Level:
MEDIUM
Description:
Installeur PolyBoard 6.04j
Exit code:
3221226540
Version:
2.2.0.3
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6564.1258\polyboard pro-pp v6.04j + crack - crackingpatching.com\installpolyboard.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6908"C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.1258\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com\installpolyboard.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6564.1258\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com\installpolyboard.exe
WinRAR.exe
User:
admin
Company:
Boole & Partners
Integrity Level:
HIGH
Description:
Installeur PolyBoard 6.04j
Exit code:
0
Version:
2.2.0.3
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6564.1258\polyboard pro-pp v6.04j + crack - crackingpatching.com\installpolyboard.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6992C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
7036C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 764
Read events
7 540
Write events
205
Delete events
19

Modification events

(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com.zip
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6908) installpolyboard.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000A676A851C84ADB01FC1A0000001B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6992) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000A676A851C84ADB01501B0000681B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
23
Suspicious files
52
Text files
23
Unknown types
7

Dropped files

PID
Process
Filename
Type
6564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6564.1258\PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com\CrackingPatching.com.URLurl
MD5:043D08A000F20571B004F1B52A4DA7D7
SHA256:09DBC34577A8D55FCBE8A4D4759E327574BDEAF1DF7629A3CA50AAC26FBAF07D
6908installpolyboard.exeC:\Users\admin\AppData\Local\Temp\boole_{85e2170d-ff69-417f-8395-8db69a3b165b}\dsetup32.dllexecutable
MD5:0F58CCD58A29827B5D406874360E4C08
SHA256:642D9E7DB6D4FC15129F011DCE2EA087BF7F7FB015AECECF82BF84FF6634A6FB
6908installpolyboard.exeC:\Windows\INF\sdatabl.sav.binbinary
MD5:373FA1A0BD8CFDEA6637DDE9F3EA8945
SHA256:ACF6EEB11FB88C7A760631B4ABE6B2A98804F8A93A63549DD7520EA8F7548553
6908installpolyboard.exeC:\ProgramData\Boole & Partners\Materials\Bar.mat-boolebinary
MD5:ADA22EACF83783149FAC8067E23BBBA3
SHA256:DA13A6CD66275ABAE69F9BDD069026EEDBE9CE3040FB89031BEB7ED17EC24CEF
6908installpolyboard.exeC:\Users\Public\Desktop\PolyBoard Examples\3_Drawers.pb-cabbinary
MD5:55FF67ED18F4F45DB878BA953449CE87
SHA256:42250E4C71E0F58407CCCFD9A028913397C30F09D65A97BECC437594BCFD229A
6908installpolyboard.exeC:\Users\admin\AppData\Local\Temp\boole_{85e2170d-ff69-417f-8395-8db69a3b165b}\Jun2010_d3dx9_43_x86.cabcompressed
MD5:7749862C307E527366B6868326DB8198
SHA256:FCC6CF0966B4853D6FA3D32AB299CDE5A9824FEAECB0D4F34EA452FB9FD1C867
6908installpolyboard.exeC:\Users\admin\AppData\Local\Temp\boole_{85e2170d-ff69-417f-8395-8db69a3b165b}\dxdllreg_x86.cabcompressed
MD5:A025C67403DC2C2BCD709AA9435FAEB1
SHA256:8AD77A4D9C76F65CD62337588F847CC1E0CA6CA9735937F3A781F7395E9566A1
6908installpolyboard.exeC:\ProgramData\Boole & Partners\Textures\PolyBoard 6\Acajou1.jpgimage
MD5:3190489426186C331135CC3086DA1750
SHA256:14CB474AC44B8C1C1E6E1B35B7459B8858D52906087C414F2EFC62412E306F2C
6908installpolyboard.exeC:\ProgramData\Boole & Partners\Textures\PolyBoard 6\Beech.jpgimage
MD5:B218CAE9E84AE0CFAE75D3BA8ACDE091
SHA256:ED7AABABC9308000802EDF3FE3B6562A1333AFCB97932769F2A6588B6E969274
6908installpolyboard.exeC:\ProgramData\Boole & Partners\Textures\PolyBoard 6\Aluminium2.jpgimage
MD5:35F87F3914F51BC5CBA665B343B8D013
SHA256:FE7B086E5284E6CC59D895BA498814581C6D3C57736D531AFD457959849C1348
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4716
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3984
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6908
installpolyboard.exe
GET
200
2.20.245.138:80
http://crl.microsoft.com/pki/crl/products/CSPCA.crl
unknown
—
—
whitelisted
3984
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5892
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.209.177:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
  • 2.20.245.138
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 2.23.209.177
  • 2.23.209.148
  • 2.23.209.150
  • 2.23.209.156
  • 2.23.209.158
  • 2.23.209.176
  • 2.23.209.160
  • 2.23.209.179
  • 2.23.209.149
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.4
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
Process
Message
installpolyboard.exe
DLL_PROCESS_ATTACH
installpolyboard.exe
DLL_PROCESS_ATTACH
installpolyboard.exe
DLL_PROCESS_DETACH
installpolyboard.exe
DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PolyBoard Pro-PP v6.04j + Crack - Crackingpatching.com.zip