| File name: | [email protected] |
| Full analysis: | https://app.any.run/tasks/5aa8777d-5670-48e8-b8e0-46357560fc12 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | January 06, 2020, 04:30:28 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 2FED47CFDCD95D4A1488DABA8E83ED39 |
| SHA1: | 169A5D11FD7AC4061912A27A50A9C4598EEC37FF |
| SHA256: | 8D594ECEE059AABEA6CCBEA8A6BEFFE684EA1A4A1E99CCB48790C585BD3CED5C |
| SSDEEP: | 196608:fip1Z2URXnTHTErvWELG+eTRXtQebv27l8Hz/eWFW9RLA+7VjuxhvnN:c2URX6WELG7ThtQebvS8qWQHA+8xL |
MALICIOUS
Registers / Runs the DLL via REGSVR32.EXE
- ClvUtility.exe (PID: 4064)
- Uninst.exe (PID: 3992)
Application was dropped or rewritten from another process
- ClvUtility.exe (PID: 4064)
- ClvUtility.exe (PID: 2040)
- ClvUtility.exe (PID: 3628)
- ClvUtility.exe (PID: 2932)
- SoftUpd.exe (PID: 2772)
- ClvUtility.exe (PID: 2960)
- ClvClient.exe (PID: 1584)
- Clover.exe (PID: 2304)
- Clover.exe (PID: 2784)
- Uninst.exe (PID: 3992)
- ClvUtility.exe (PID: 3296)
Loads dropped or rewritten executable
- regsvr32.exe (PID: 1516)
- regsvr32.exe (PID: 2408)
- svchost.exe (PID: 3476)
- ClvUtility.exe (PID: 3628)
- Clover.exe (PID: 2304)
- SoftUpd.exe (PID: 2772)
- svchost.exe (PID: 864)
- explorer.exe (PID: 352)
- Clover.exe (PID: 2784)
- Uninst.exe (PID: 3992)
- regsvr32.exe (PID: 3956)
SOFTCNAPP was detected
- svchost.exe (PID: 3476)
- ClvClient.exe (PID: 1584)
- SoftUpd.exe (PID: 2772)
- ClvUtility.exe (PID: 2960)
Connects to CnC server
- ClvUtility.exe (PID: 4064)
- ClvUtility.exe (PID: 2960)
SUSPICIOUS
Creates files in the program directory
- [email protected] (PID: 564)
- ClvUtility.exe (PID: 2932)
- Clover.exe (PID: 2304)
- ClvClient.exe (PID: 1584)
Low-level read access rights to disk partition
- ClvUtility.exe (PID: 4064)
- ClvUtility.exe (PID: 3296)
Creates a software uninstall entry
- ClvUtility.exe (PID: 4064)
Application launched itself
- ClvUtility.exe (PID: 4064)
Creates COM task schedule object
- regsvr32.exe (PID: 1516)
Executable content was dropped or overwritten
- [email protected] (PID: 564)
- Uninst.exe (PID: 3992)
- ClvClient.exe (PID: 1584)
Creates or modifies windows services
- ClvUtility.exe (PID: 3628)
Creates files in the user directory
- ClvUtility.exe (PID: 2932)
- SoftUpd.exe (PID: 2772)
Creates files in the Windows directory
- ClvClient.exe (PID: 1584)
Executed via COM
- DllHost.exe (PID: 3496)
Searches for installed software
- ClvClient.exe (PID: 1584)
- explorer.exe (PID: 352)
INFO
Dropped object may contain Bitcoin addresses
- [email protected] (PID: 564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (46.3) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (41) |
| .exe | | | Win32 Executable (generic) (6.6) |
| .exe | | | Generic Win/DOS Executable (2.9) |
| .exe | | | DOS Executable Generic (2.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:08:09 05:38:10+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 819200 |
| InitializedDataSize: | 11452416 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x45a68 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.5.2.19809 |
| ProductVersionNumber: | 3.5.2.19809 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Windows, Chinese (Simplified) |
| Comments: | Clover 安装程序 |
| CompanyName: | ejie.me |
| FileDescription: | Clover 安装程序 |
| FileVersion: | 3.5.2.19809 |
| InternalName: | Clover |
| LegalCopyright: | Copyright (C) 2018 |
| OriginalFileName: | Clover.exe |
| ProductName: | Clover |
| ProductVersion: | 3.5.2.19809 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 09-Aug-2019 03:38:10 |
| Detected languages: |
|
| Debug artifacts: |
|
| Comments: | Clover 安装程序 |
| CompanyName: | ejie.me |
| FileDescription: | Clover 安装程序 |
| FileVersion: | 3.5.2.19809 |
| InternalName: | Clover |
| LegalCopyright: | Copyright (C) 2018 |
| OriginalFilename: | Clover.exe |
| ProductName: | Clover |
| ProductVersion: | 3.5.2.19809 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000118 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 4 |
| Time date stamp: | 09-Aug-2019 03:38:10 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000C7D87 | 0x000C8000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.63818 |
.rdata | 0x000C9000 | 0x0003ED5D | 0x0003F000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.60523 |
.data | 0x00108000 | 0x0000B37C | 0x00004000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.22694 |
.rsrc | 0x00114000 | 0x00AA82F8 | 0x00AA9000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.99957 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.38137 | 1029 | Latin 1 / Western European | Chinese - PRC | RT_MANIFEST |
2 | 5.49971 | 4264 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
3 | 5.54923 | 2440 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
4 | 5.7222 | 1128 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
5 | 3.02695 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
6 | 2.74274 | 180 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
7 | 2.09229 | 66 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
8 | 2.34004 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
9 | 2.51649 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
10 | 2.45401 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
IMM32.dll |
KERNEL32.dll |
OLEACC.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
Exports
Title | Ordinal | Address |
|---|---|---|
??0CActiveXUI@DuiLib@@QAE@ABV01@@Z | 1 | 0x000937F6 |
??0CActiveXUI@DuiLib@@QAE@XZ | 2 | 0x000B1E54 |
??0CButtonGifUI@DuiLib@@QAE@ABV01@@Z | 3 | 0x00092F35 |
??0CButtonGifUI@DuiLib@@QAE@XZ | 4 | 0x000AC7F3 |
??0CButtonUI@DuiLib@@QAE@ABV01@@Z | 5 | 0x00092D1A |
??0CButtonUI@DuiLib@@QAE@XZ | 6 | 0x000ABB6D |
??0CCheckBoxUI@DuiLib@@QAE@ABV01@@Z | 7 | 0x00093207 |
??0CCheckBoxUI@DuiLib@@QAE@XZ | 8 | 0x000931A3 |
??0CChildLayoutUI@DuiLib@@QAE@ABV01@@Z | 9 | 0x000943A5 |
??0CChildLayoutUI@DuiLib@@QAE@XZ | 10 | 0x000B4D39 |
Total processes
62
Monitored processes
23
Malicious processes
11
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 352 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 564 | "C:\Users\admin\AppData\Local\Temp\[email protected]" | C:\Users\admin\AppData\Local\Temp\[email protected] | explorer.exe | ||||||||||||
User: admin Company: ejie.me Integrity Level: HIGH Description: Clover 安装程序 Exit code: 0 Version: 3.5.2.19809 Modules
| |||||||||||||||
| 864 | C:\Windows\system32\svchost.exe -k netsvcs | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1428 | regsvr32 /s /u "C:\Program Files\Clover\\TabHelper64.dll" | C:\Windows\system32\regsvr32.exe | — | ClvUtility.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1516 | regsvr32 /s "C:\Program Files\Clover\\TabHelper32.dll" | C:\Windows\system32\regsvr32.exe | — | ClvUtility.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1584 | "C:\Program Files\Clover\ClvClient.exe" RunAssist | C:\Program Files\Clover\ClvClient.exe | svchost.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Description: Clover辅助程序 Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 2040 | "C:\Program Files\Clover\ClvUtility.exe" SetSpreader --qid clover200200106 --time 1578285061 | C:\Program Files\Clover\ClvUtility.exe | — | ClvUtility.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Clover 辅助程序 Exit code: 0 Version: 1,0,1,0 Modules
| |||||||||||||||
| 2304 | "C:\Program Files\Clover\Clover.exe" | C:\Program Files\Clover\Clover.exe | [email protected] | ||||||||||||
User: admin Company: www.ejie.me Integrity Level: HIGH Description: Clover Exit code: 0 Version: 3.4.8.19509 Modules
| |||||||||||||||
| 2408 | regsvr32 /s /u "C:\Program Files\Clover\\TabHelper32.dll" | C:\Windows\system32\regsvr32.exe | — | ClvUtility.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2772 | "C:\Program Files\Clover\SoftUpd.exe" RunAuto | C:\Program Files\Clover\SoftUpd.exe | svchost.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3.5.1.19809 Modules
| |||||||||||||||
Total events
8 627
Read events
7 950
Write events
645
Delete events
32
Modification events
| (PID) Process: | (352) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (564) [email protected] | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Clover |
| Operation: | write | Name: | LastInstallTime |
Value: 0 | |||
| (PID) Process: | (564) [email protected] | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Clover |
| Operation: | write | Name: | InstallPath |
Value: C:\Program Files\Clover\ | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Clover |
| Operation: | write | Name: | InstallPath |
Value: C:\Program Files\Clover\ | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Clover |
| Operation: | write | Name: | DisplayName |
Value: Clover V3.5 | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Clover |
| Operation: | write | Name: | UninstallString |
Value: C:\Program Files\Clover\Uninst.exe | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Clover |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\Clover\Clover.exe | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Clover |
| Operation: | write | Name: | DisplayVersion |
Value: 3.5.2.19809 | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Clover |
| Operation: | write | Name: | Publisher |
Value: 易捷科技 | |||
| (PID) Process: | (4064) ClvUtility.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Clover |
| Operation: | write | Name: | URLInfoAbout |
Value: http://ejie.me/ | |||
Executable files
33
Suspicious files
8
Text files
95
Unknown types
12
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 564 | [email protected] | C:\Users\admin\AppData\Local\Temp\my7zData.7z | — | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Users\admin\AppData\LocalLow\Clover\Config\UseVestige.ini | text | |
MD5:— | SHA256:— | |||
| 864 | svchost.exe | C:\Windows\appcompat\programs\RecentFileCache.bcf | txt | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Common Files\Clover\Clover.ini | text | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Clover\CloverInfo.ini | text | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Clover\ClvClient.exe | executable | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Clover\CloverAss.exe | executable | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Clover\Clover.exe | executable | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Clover\ClvUtility.exe | executable | |
MD5:— | SHA256:— | |||
| 564 | [email protected] | C:\Program Files\Clover\SoftUpd.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
26
DNS requests
13
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
564 | GET | — | 106.75.47.98:80 | http://tjv1.ejie.me/statistics/timestamp | CN | — | — | malicious | |
4064 | ClvUtility.exe | GET | — | 106.75.47.98:80 | http://tj.shusw.com/statistics/sign?code=VUlELDljMDUzZTJmMTEwMmI3Yjc4ZWFjNzBlMzQwYjIzZTY0LFFJRCxjbG92ZXIyMDAxMDYsU29mdElELENsb3ZlcixJc09sZCwwLElzV0IsMA== | CN | — | — | malicious |
3476 | svchost.exe | GET | — | 117.50.93.3:80 | http://tjtv3.shusw.com/fdot.php?data=MjE3MTc2MTEwNDMyMzMyNTE5NjkxOTEwMzMyNDAzMzkzMzY5NjI1MzAzMjIzNzM2MTk2NzUwMTAwMzMyMzM3MDMzMjY2MDY3MTkyMDQ4MzYzMzIyMTkxMDE5MjIyNzY4Mjc1NjM5MTEzNzI0NDY1MzM0MzIxOTM1MDk3MDE0MTAyMzIyNTQyNTMzMjA1NDI1MzMyMDA1MjUxOTY0MzgyNDI0NDcxNzM4NjY0NzQ5MTAyNDA4MjIyNDEwMDkyMDM4MjQzMTQ1NjUzMzU1NjcyNDA3NTk3MDA3MTExNDY3MzgzNTE3MTEzODA2NDUxNTY1NDY1NjEwMDYxNDI2MTU3MDIzNjcyMzY4MzM1MzU5NDI0NzIyNTQwNjMzNjkwNzU5MzMyMDA3NTc%3D | CN | — | — | malicious |
2960 | ClvUtility.exe | GET | — | 106.75.47.98:80 | http://tjv1.shusw.com/statistics/timestamp | CN | — | — | malicious |
4064 | ClvUtility.exe | GET | — | 106.75.47.98:80 | http://tj.shusw.com/statistics/sign?code=VUlELDljMDUzZTJmMTEwMmI3Yjc4ZWFjNzBlMzQwYjIzZTY0LFFJRCxjbG92ZXIyMDAxMDYsU29mdElELENsb3ZlcixJc09sZCwwLElzV0IsMA== | CN | — | — | malicious |
1584 | ClvClient.exe | GET | — | 106.75.25.83:80 | http://cid.shusw.com/soft/jt?uid=4b47041b82a10ad22f23c2d26b500689&qid=clover200200106&softname=shurufa&softid=clover&softver= | CN | — | — | malicious |
1584 | ClvClient.exe | GET | — | 117.50.93.3:80 | http://tjtv3.shusw.com/pipil.php | CN | — | — | malicious |
2960 | ClvUtility.exe | GET | — | 106.75.47.98:80 | http://tj.shusw.com/statistics/online?code=VUlELDNkMmU4NzZmZmJhYjY4NDg1NGZlMzg1YzhjYmRiNWEzLFFJRCxjbG92ZXIyMDAyMDAxMDYsU29mdE5hbWUsQ2xvdmVyLFNvZnRJRCxDbG92ZXIsU29mdFZlciwzLjUuMS4yLFR5cGUsMA== | CN | — | — | malicious |
4064 | ClvUtility.exe | GET | — | 106.75.47.98:80 | http://tj.shusw.com/statistics/install?code=VUlELDljMDUzZTJmMTEwMmI3Yjc4ZWFjNzBlMzQwYjIzZTY0LFFJRCxjbG92ZXIyMDAxMDYsU29mdE5hbWUsQ2xvdmVyLFNvZnRJRCxDbG92ZXIsU29mdFZlciwzLjUuMS4yLElzT2xkLDAsSXNXQiwwLFRpbWUsLFNpZ24s | CN | — | — | malicious |
2960 | ClvUtility.exe | GET | — | 106.75.47.98:80 | http://tjv1.shusw.com/statistics/cloversoftlist?code=dWlkLDNkMmU4NzZmZmJhYjY4NDg1NGZlMzg1YzhjYmRiNWEzLHFpZCxjbG92ZXIyMDAyMDAxMDYsc29mdHR5cGUsQ2xvdmVyLHNvZnRuYW1lLENsb3Zlcix2ZXIsMy41LjEuMixzb2Z0bGlzdCwzNjBBUVdTLTAwMHxRUUdKLTAwMHxKU0RCLTAwMHxIUi0wMDB8TERTLTAwMA== | CN | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
564 | 47.89.39.18:80 | config.ejie.me | Alibaba (China) Technology Co., Ltd. | HK | malicious | |
564 | 106.75.47.98:80 | tjv1.ejie.me | China Unicom Beijing Province Network | CN | malicious | |
4064 | ClvUtility.exe | 106.75.47.98:80 | tjv1.ejie.me | China Unicom Beijing Province Network | CN | malicious |
3476 | svchost.exe | 163.171.140.179:80 | down.shusw.com | — | US | malicious |
2960 | ClvUtility.exe | 106.75.47.98:80 | tjv1.ejie.me | China Unicom Beijing Province Network | CN | malicious |
3476 | svchost.exe | 117.50.93.3:80 | tjtv3.shusw.com | IDC, China Telecommunications Corporation | CN | malicious |
2772 | SoftUpd.exe | 47.89.39.18:80 | config.ejie.me | Alibaba (China) Technology Co., Ltd. | HK | malicious |
2304 | Clover.exe | 172.217.17.110:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
1584 | ClvClient.exe | 163.171.140.179:80 | down.shusw.com | — | US | malicious |
2960 | ClvUtility.exe | 47.89.39.18:80 | config.ejie.me | Alibaba (China) Technology Co., Ltd. | HK | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tjv1.ejie.me |
| unknown |
config.ejie.me |
| unknown |
tj.shusw.com |
| malicious |
down.shusw.com |
| suspicious |
tjtv3.shusw.com |
| unknown |
tjv1.shusw.com |
| malicious |
updatecn.ejie.me |
| malicious |
www.google-analytics.com |
| whitelisted |
cid.shusw.com |
| malicious |
downsrf.eastday.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ADWARE [PTsecurity] PUA.Softcnapp payload |
— | — | Misc activity | ADWARE [PTsecurity] PUA.Softcnapp payload |
— | — | Misc activity | ADWARE [PTsecurity] Softcnapp.J PUP |
— | — | Misc activity | ADWARE [PTsecurity] PUA.Softcnapp payload |
— | — | Misc activity | ADWARE [PTsecurity] Softcnapp.J PUP |
— | — | Misc activity | ADWARE [PTsecurity] PUA.Softcnapp payload |
5 ETPRO signatures available at the full report
Process | Message |
|---|---|
svchost.exe | CreateProcessAsUser ok!
|
svchost.exe | CreateProcessAsUser ok!
|