File name:

setup_clover@3.5.4.exe

Full analysis: https://app.any.run/tasks/35f6b4f0-edb1-4160-8c73-743517527690
Verdict: Malicious activity
Analysis date: December 20, 2024, 14:47:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

12A57F152E0FC65517B1C22629F87430

SHA1:

F5CF35BF021675B02C8299CFF95E53DC6DB95890

SHA256:

9847281C4CACA7B50D73839B8D1A8426A16D55C551EBD55C5854F29BCF517910

SSDEEP:

196608:fgJIqr+XnTHTDwTnH01T6yzGAKV+WRjgtgEYcK7yEbDj0Hm+9/3OeuWLKCgOEFaV:2Iqr+XT601T62CUgEYcgyC0H39Bl5gbQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • ClvUtility.exe (PID: 3696)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup_clover@3.5.4.exe (PID: 6752)

    • Reads security settings of Internet Explorer

      • ClvUtility.exe (PID: 3696)
      • SoftUpd.exe (PID: 5032)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 556)
      • regsvr32.exe (PID: 3792)

    • Application launched itself

      • ClvUtility.exe (PID: 3696)

    • Creates a software uninstall entry

      • ClvUtility.exe (PID: 3696)

    • Creates or modifies Windows services

      • ClvUtility.exe (PID: 3560)

    • Searches for installed software

      • ClvUtility.exe (PID: 3696)

  • INFO

    • The sample compiled with chinese language support

      • setup_clover@3.5.4.exe (PID: 6752)

    • Reads the computer name

      • setup_clover@3.5.4.exe (PID: 6752)
      • ClvUtility.exe (PID: 3696)
      • ClvUtility.exe (PID: 6288)
      • ClvUtility.exe (PID: 3560)
      • ClvUtility.exe (PID: 4516)
      • Clover.exe (PID: 4320)
      • ClvUtility.exe (PID: 6852)
      • SoftUpd.exe (PID: 5032)
      • Clover.exe (PID: 7096)
      • ClvUtility.exe (PID: 3568)

    • Creates files in the program directory

      • setup_clover@3.5.4.exe (PID: 6752)
      • ClvUtility.exe (PID: 4516)
      • Clover.exe (PID: 4320)

    • Checks supported languages

      • setup_clover@3.5.4.exe (PID: 6752)
      • ClvUtility.exe (PID: 3696)
      • ClvUtility.exe (PID: 6288)
      • ClvUtility.exe (PID: 3560)
      • SoftUpd.exe (PID: 5032)
      • Clover.exe (PID: 4320)
      • ClvUtility.exe (PID: 4516)
      • ClvUtility.exe (PID: 6852)
      • Clover.exe (PID: 7096)
      • ClvUtility.exe (PID: 3568)

    • Creates files or folders in the user directory

      • setup_clover@3.5.4.exe (PID: 6752)
      • ClvUtility.exe (PID: 4516)
      • SoftUpd.exe (PID: 5032)

    • Create files in a temporary directory

      • setup_clover@3.5.4.exe (PID: 6752)
      • SoftUpd.exe (PID: 5032)

    • The sample compiled with english language support

      • setup_clover@3.5.4.exe (PID: 6752)

    • Process checks computer location settings

      • ClvUtility.exe (PID: 3696)

    • The process uses the downloaded file

      • ClvUtility.exe (PID: 3696)

    • Sends debugging messages

      • Clover.exe (PID: 4320)

    • Manual execution by a user

      • Clover.exe (PID: 7096)

    • Checks proxy server information

      • SoftUpd.exe (PID: 5032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:04:22 11:23:06+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 819200
InitializedDataSize: 11587584
UninitializedDataSize: -
EntryPoint: 0x45ae8
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.5.4.20416
ProductVersionNumber: 3.5.4.20416
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
Comments: Clover 安装程序
CompanyName: ejie.me
FileDescription: Clover 安装程序
FileVersion: 3.5.4.20416
InternalName: Clover
LegalCopyright: Copyright (C) 2020
OriginalFileName: Clover.exe
ProductName: Clover
ProductVersion: 3.5.4.20416
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
18
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup_clover@3.5.4.exe clvutility.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs clvutility.exe no specs clvutility.exe no specs clvutility.exe no specs clover.exe softupd.exe clvutility.exe no specs rundll32.exe no specs clover.exe no specs clvutility.exe setup_clover@3.5.4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440regsvr32 /s /u "C:\Program Files (x86)\Clover\\TabHelper32.dll"C:\Windows\SysWOW64\regsvr32.exe—ClvUtility.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
556regsvr32 /s "C:\Program Files (x86)\Clover\\TabHelper32.dll"C:\Windows\SysWOW64\regsvr32.exe—ClvUtility.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3560"C:\Program Files (x86)\Clover\ClvUtility.exe" InstallServiceC:\Program Files (x86)\Clover\ClvUtility.exe—setup_clover@3.5.4.exe
User:
admin
Integrity Level:
HIGH
Description:
Clover 辅助程序
Exit code:
0
Version:
1,0,1,0
Modules
Images
c:\program files (x86)\clover\clvutility.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3568"C:\Program Files (x86)\Clover\ClvUtility.exe" SetSpreader --qid clover241241220 --time 1734706186C:\Program Files (x86)\Clover\ClvUtility.exe
ClvUtility.exe
User:
admin
Integrity Level:
HIGH
Description:
Clover 辅助程序
Exit code:
0
Version:
1,0,1,0
Modules
Images
c:\program files (x86)\clover\clvutility.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3696"C:\Program Files (x86)\Clover\\ClvUtility.exe" InstallSpreadOperate clover241220,,0C:\Program Files (x86)\Clover\ClvUtility.exe
setup_clover@3.5.4.exe
User:
admin
Integrity Level:
HIGH
Description:
Clover 辅助程序
Exit code:
0
Version:
1,0,1,0
Modules
Images
c:\program files (x86)\clover\clvutility.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3792 /s "C:\Program Files (x86)\Clover\\TabHelper64.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4320"C:\Program Files (x86)\Clover\Clover.exe"C:\Program Files (x86)\Clover\Clover.exe
setup_clover@3.5.4.exe
User:
admin
Company:
www.ejie.me
Integrity Level:
MEDIUM
Description:
Clover
Exit code:
0
Version:
3.5.4.20416
Modules
Images
c:\program files (x86)\clover\clover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4516"C:\Program Files (x86)\Clover\\ClvUtility.exe" CreateStartMenu 1C:\Program Files (x86)\Clover\ClvUtility.exe—setup_clover@3.5.4.exe
User:
admin
Integrity Level:
HIGH
Description:
Clover 辅助程序
Exit code:
0
Version:
1,0,1,0
Modules
Images
c:\program files (x86)\clover\clvutility.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5032"C:\Program Files (x86)\Clover\SoftUpd.exe" RunAutoC:\Program Files (x86)\Clover\SoftUpd.exe
Clover.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.5.4.20416
Modules
Images
c:\program files (x86)\clover\softupd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5464regsvr32 /s /u "C:\Program Files (x86)\Clover\\TabHelper64.dll"C:\Windows\SysWOW64\regsvr32.exe—ClvUtility.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
4 797
Read events
4 751
Write events
46
Delete events
0

Modification events

(PID) Process:(6752) setup_clover@3.5.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Clover
Operation:writeName:LastInstallTime
Value:
0
(PID) Process:(6752) setup_clover@3.5.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Clover
Operation:writeName:InstallPath
Value:
C:\Program Files (x86)\Clover\
(PID) Process:(6752) setup_clover@3.5.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clover
Operation:writeName:InstallPath
Value:
C:\Program Files (x86)\Clover\
(PID) Process:(3792) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\TabHelper.DLL
Operation:writeName:AppID
Value:
{3D8758D6-6EEF-453D-B910-391ABFFFD326}
(PID) Process:(3792) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(3696) ClvUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clover
Operation:writeName:InstallPath
Value:
C:\Program Files (x86)\Clover\
(PID) Process:(3696) ClvUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Clover
Operation:writeName:DisplayName
Value:
Clover V3.5
(PID) Process:(3696) ClvUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Clover
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\Clover\Uninst.exe
(PID) Process:(3696) ClvUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Clover
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Clover\Clover.exe
(PID) Process:(3696) ClvUtility.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Clover
Operation:writeName:DisplayVersion
Value:
3.5.4.20416
Executable files
29
Suspicious files
14
Text files
11
Unknown types
1

Dropped files

PID
Process
Filename
Type
6752setup_clover@3.5.4.exeC:\Users\admin\AppData\Local\Temp\my7zData.7z —
MD5:—
SHA256:—
6752setup_clover@3.5.4.exeC:\Users\admin\AppData\LocalLow\Clover\Config\UseVestige.initext
MD5:382B2EAF20F7230F2959D6EBEAFC7845
SHA256:5EE6450A2B30CF64CDEDC274837F406885694F1C0A86249FAA1801E4F89F7AAD
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Common Files\Clover\Clover.initext
MD5:7AE7390B4FD7F79667F40101E174E7E0
SHA256:4EE0E8B8789E61C80CC151D54CB8C6ACE2A6B744703A46CAF3D63C8CD85AED73
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\lang\lang_index.xmlxml
MD5:927C5543CBEE0F8A06F2589B84D75781
SHA256:B2165610C2519DE6580E80A208D4126976314CFEC60AB08918CC335B937D7E65
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\ico\jd.pngimage
MD5:F01765E7A55B8BC53CA72BFEFBD8542E
SHA256:3B2AEEDC35262E3D8188B70F307217FEE3DA19518F4CBE3F97D516DA79308249
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\ico\baidu.pngimage
MD5:064F3B680CC5E020F6A8E0C5E005B787
SHA256:5B5937A7AB24C2C7ADE09B04C807B4B4290A22FA2F110A84CF1614BEE0C52CE4
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\CloverInfo.initext
MD5:EFA85F0CED4BE6AF19136214B95361F0
SHA256:4BAA03530BA8DC5A4809190B9E1752E0A6B872514B474107AC6423452E855B64
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\appconfig.datbinary
MD5:1FF0200124BCC8EA6316732FDC754828
SHA256:36AE2957E42498E8FFF9D258FEB0121D3F085B6F79CE013B4CE3B0F176A2E01E
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\ico\taobao.pngimage
MD5:733F9F84C062D33C14D8DC16157AF9F8
SHA256:DB5703CB584F8175D9F5282D4F74A1263EBB17285D3C1112AAE883EB7D3FE64C
6752setup_clover@3.5.4.exeC:\Program Files (x86)\Clover\data\____.datimage
MD5:064F3B680CC5E020F6A8E0C5E005B787
SHA256:5B5937A7AB24C2C7ADE09B04C807B4B4290A22FA2F110A84CF1614BEE0C52CE4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
67
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3220
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3220
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5432
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5432
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6752
setup_clover@3.5.4.exe
GET
404
47.89.39.18:80
http://config.ejie.me/install/clover/3.5.4.20416.dat
unknown
—
—
whitelisted
6412
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3220
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3220
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.23.209.154:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.51
  • 2.16.164.97
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 2.23.209.154
  • 2.23.209.162
  • 2.23.209.158
  • 2.23.209.157
  • 2.23.209.156
  • 2.23.209.160
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.166
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.73
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
tjv1.ejie.me
  • 106.75.47.98
whitelisted
config.ejie.me
  • 47.89.39.18
whitelisted

Threats

No threats detected
Process
Message
Clover.exe
CreateProcessAsUser ok!
Clover.exe
CreateProcessAsUser ok!
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_clover@3.5.4.exe