Analysis
-
max time kernel
149s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-09-2021 07:00
Static task
static1
Behavioral task
behavioral1
Sample
CloverPortable_3.4.5_32_64_bit.paf.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
CloverPortable_3.4.5_32_64_bit.paf.exe
Resource
win10v20210408
General
-
Target
CloverPortable_3.4.5_32_64_bit.paf.exe
-
Size
4.9MB
-
MD5
714866a057e7a1baca8163c477de1649
-
SHA1
0c51232413e20d2f1729acc495b83a24bd9c78ff
-
SHA256
0cd705341453bcd20ea0d533a877d955858e63e3ac79113b3029ab2f2390a848
-
SHA512
955f5f122f110b06183cbdd0eb5e6973aba343a098b02d3917324eb411edd04207c813c73be926d8ef1602b73ac1ab9c7c39efecd7fcdd1d3189e63a7b2b05bf
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
CloverPortable.execlover.exepid process 3256 CloverPortable.exe 1360 clover.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 17 IoCs
Processes:
CloverPortable_3.4.5_32_64_bit.paf.exeCloverPortable.exeregsvr32.exeregsvr32.execlover.exepid process 856 CloverPortable_3.4.5_32_64_bit.paf.exe 856 CloverPortable_3.4.5_32_64_bit.paf.exe 856 CloverPortable_3.4.5_32_64_bit.paf.exe 856 CloverPortable_3.4.5_32_64_bit.paf.exe 856 CloverPortable_3.4.5_32_64_bit.paf.exe 856 CloverPortable_3.4.5_32_64_bit.paf.exe 3256 CloverPortable.exe 3256 CloverPortable.exe 3256 CloverPortable.exe 3256 CloverPortable.exe 3256 CloverPortable.exe 2212 regsvr32.exe 2392 regsvr32.exe 2740 1360 clover.exe 1360 clover.exe 1360 clover.exe -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Program Files directory 1 IoCs
Processes:
clover.exedescription ioc process File opened for modification C:\Program Files (x86)\Clover\CloverInfo.ini clover.exe -
Drops file in Windows directory 1 IoCs
Processes:
clover.exedescription ioc process File opened for modification C:\Windows\ clover.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 53 IoCs
Processes:
regsvr32.exeCloverPortable_3.4.5_32_64_bit.paf.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TabHelper.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher.1\ = "ExplorerWatcher Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\VersionIndependentProgID\ = "TabHelper.ExplorerWatcher" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher.1\CLSID\ = "{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\HELPDIR\ = "C:\\clover\\CloverPortable\\App\\Clover" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\TypeLib\ = "{63F1F5B5-238F-4205-B166-D1BF6E351BDC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3D8758D6-6EEF-453D-B910-391ABFFFD326} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\TypeLib\ = "{63F1F5B5-238F-4205-B166-D1BF6E351BDC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3D8758D6-6EEF-453D-B910-391ABFFFD326}\ = "TabHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher\CurVer\ = "TabHelper.ExplorerWatcher.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\TypeLib\ = "{63F1F5B5-238F-4205-B166-D1BF6E351BDC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\ProgID\ = "TabHelper.ExplorerWatcher.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher\ = "ExplorerWatcher Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings CloverPortable_3.4.5_32_64_bit.paf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\ = "ExplorerWatcher Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\InprocServer32\ = "C:\\clover\\CloverPortable\\App\\Clover\\TabHelper64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance CloverPortable_3.4.5_32_64_bit.paf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TabHelper.ExplorerWatcher\CLSID\ = "{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TabHelper.DLL\AppID = "{3D8758D6-6EEF-453D-B910-391ABFFFD326}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\ = "IExplorerWatcher" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\ = "TabHelper 1.0 ÀàÐÍ¿â" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{63F1F5B5-238F-4205-B166-D1BF6E351BDC}\1.0\0\win64\ = "C:\\clover\\CloverPortable\\App\\Clover\\TabHelper64.dll" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance CloverPortable_3.4.5_32_64_bit.paf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD448767-930B-442A-9F4D-EF9AA999C4E8}\ = "IExplorerWatcher" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
CloverPortable_3.4.5_32_64_bit.paf.exeCloverPortable.execlover.exepid process 856 CloverPortable_3.4.5_32_64_bit.paf.exe 856 CloverPortable_3.4.5_32_64_bit.paf.exe 3256 CloverPortable.exe 3256 CloverPortable.exe 1360 clover.exe 1360 clover.exe 1360 clover.exe 1360 clover.exe 1360 clover.exe 1360 clover.exe 1360 clover.exe 1360 clover.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
CloverPortable_3.4.5_32_64_bit.paf.exepid process 856 CloverPortable_3.4.5_32_64_bit.paf.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
CloverPortable_3.4.5_32_64_bit.paf.execlover.exepid process 856 CloverPortable_3.4.5_32_64_bit.paf.exe 1360 clover.exe 1360 clover.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
regsvr32.exepid process 2392 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
CloverPortable.exeregsvr32.exedescription pid process target process PID 3256 wrote to memory of 2212 3256 CloverPortable.exe regsvr32.exe PID 3256 wrote to memory of 2212 3256 CloverPortable.exe regsvr32.exe PID 3256 wrote to memory of 2212 3256 CloverPortable.exe regsvr32.exe PID 2212 wrote to memory of 2392 2212 regsvr32.exe regsvr32.exe PID 2212 wrote to memory of 2392 2212 regsvr32.exe regsvr32.exe PID 3256 wrote to memory of 1360 3256 CloverPortable.exe clover.exe PID 3256 wrote to memory of 1360 3256 CloverPortable.exe clover.exe PID 3256 wrote to memory of 1360 3256 CloverPortable.exe clover.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CloverPortable_3.4.5_32_64_bit.paf.exe"C:\Users\Admin\AppData\Local\Temp\CloverPortable_3.4.5_32_64_bit.paf.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\clover\CloverPortable\CloverPortable.exe"C:\clover\CloverPortable\CloverPortable.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\clover\CloverPortable\App\Clover\TabHelper64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\clover\CloverPortable\App\Clover\TabHelper64.dll"3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\clover\CloverPortable\App\Clover\clover.exe"C:\clover\CloverPortable\App\Clover\clover.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\clover\CloverPortable\App\AppInfo\Launcher\CloverPortable.iniMD5
8ccc261d861e929baa1e996042f39faa
SHA15d09011fc1b86d3ea941d7a0199a6b4c1511020b
SHA256eed750f6bed913966afc1dcbec72b300de0fa215615cc00cad07ff0d5f74b989
SHA512c4a686410d87b7c4a1cc3dca4c6cc768f3791eb7e8569f2a9cec5849499a2067b7d3b939f60d1a4d78e80cced59da0708fe5cca4845932e99a8deba4afc2690d
-
C:\clover\CloverPortable\App\AppInfo\appinfo.iniMD5
72285d66f1e73e1b47ead92298069eaa
SHA1d0a2bed1ff3e126b6692bb0226b1b4329d0860a5
SHA256f3ca78a94372d85b22d61a4ffaa8c01fcc2accd3dd4e5e59cb213190c64e1ef3
SHA512019e1f021b83964b151ab4ecc1b1103348ed08ab86c82dc1bd3f3448e57feb1cef06b0c1752369c58b87d18c92f067bf7b7f9a04cd0f1879e538a405e849d282
-
C:\clover\CloverPortable\App\Clover\Clover.exeMD5
c9ca9bb3f1d61124d91dda59abc59ca6
SHA1f5afd79987e2dba8007c1ea32bb7ecd3503cdd61
SHA256326f2ddb3ce43ce64de3e4e97464aa3bfdde604a93bf9f7141b9de7fc8367f13
SHA51297d361f0e5660aae5019c3684e4dda341e98384f9b262aa3fe8e1124eb77adcfd7fed38c597ed4065259e754991170a4ccecf4fff8b4de3087c351dae1a0af8e
-
C:\clover\CloverPortable\App\Clover\CloverInfo.iniMD5
728aa91876960c627c5ebff60fbf9557
SHA15fb582e97cab7a3583eed18a80d89e9afb8abdf9
SHA2565d0c2e0ab5aac555c69c73b2cecb6937d263aa484c02e2e08453a8c121c3b72f
SHA512b1bcebc7ddbc650d0eacf1830a7a1e0fe40a90e079c33ce4658d91ac3fcfc0d1db4160ac31b481b525453e3a5fcd558a5e83b2dcfc9b2ff794ef0c4bda0797b2
-
C:\clover\CloverPortable\App\Clover\TabHelper64.dllMD5
643d2b4e7c1c0b8b01d2fd41a924af80
SHA164a8665c98c4af9c97e8d937994c0a5bcd73d221
SHA256e02c54b4f65d73b90a009e404464061e5f08be962f8268a79431b9683678e5ac
SHA5123c31370ac2a75465dd2c4de635a5d18be8d8c6ac4055398dd4b05d5b9566de3ff9518dcc3c893326d388ed9b4985d0553cb01c94b6aaa145eb0c6429097f1061
-
C:\clover\CloverPortable\App\Clover\UtilWnd.dllMD5
a72206185fa4e7d05445fc26658541ff
SHA189a3140230ab3dec3e49aa6a5017f869049242c1
SHA256bb88206baf5fdc39cc1460ec253d14ed1b18acc16ef94b7610d074069267b0e3
SHA512414b8a2832346b53579be13185870a3ffd1a3c09a9b40ec3ff956c5211af47061fabab14a40545c62794fad5993048fd3190a59de1279e0c2f3e786659b3a9c0
-
C:\clover\CloverPortable\App\Clover\clover.exeMD5
c9ca9bb3f1d61124d91dda59abc59ca6
SHA1f5afd79987e2dba8007c1ea32bb7ecd3503cdd61
SHA256326f2ddb3ce43ce64de3e4e97464aa3bfdde604a93bf9f7141b9de7fc8367f13
SHA51297d361f0e5660aae5019c3684e4dda341e98384f9b262aa3fe8e1124eb77adcfd7fed38c597ed4065259e754991170a4ccecf4fff8b4de3087c351dae1a0af8e
-
C:\clover\CloverPortable\App\Clover\clover_dll.dllMD5
b4f7eae217bb80fdab69e7f87917dbb8
SHA15729c7c9c249699112fb125de3acc8040ac7b288
SHA25642066fa459f09670b73545010dd9f3fd1227d4468a76d8d524e2ab4eee7c0b4a
SHA51279dafae8d4fb6121988d598f27bf8135bc0180a78b39b2ebae8a82dfe67d78dd48b6fb9e23314553af577167c64e4c4b8edf8503fd3db305fe47e48b2fdb8a06
-
C:\clover\CloverPortable\App\Clover\config.iniMD5
d7d66be46af50158d165b6e0a7521c33
SHA164930d3845b6851d9afb3ec13f76bdcaaefc0a98
SHA256879ead9cb74cc12f2efd84d2270fe0ecdfb526bb6b645d750c78d4a293c0bea5
SHA512db10ceb3b4223ad4b197f200d7ddc1acf2821bcd8681b9aba756ecdfeed496a50f809cac73ddffd164cbd50a37c8ac50d538c84d97765c41b6031e374a127821
-
C:\clover\CloverPortable\App\Clover\lang\lang_index.xmlMD5
927c5543cbee0f8a06f2589b84d75781
SHA1d8a1e253eca91eb0718036bd7138205748c2e2f9
SHA256b2165610c2519de6580e80a208d4126976314cfec60ab08918cc335b937d7e65
SHA51273ff9f7c3d988bfcf286035731bc595356f488bff691de762426c20beeb78b586d3bb8cbaf1c9eb3fd6f334c397558d1297757b8e793e10c0e9a0787678b46ad
-
C:\clover\CloverPortable\App\Clover\lang\uires_en.dllMD5
1e2310c7fad9847a25d199c7fa9d5af7
SHA154847d240e67c9ecca37b039a46b6908480d38c0
SHA256edf0ec48019fe0161fc6189af0d8d5beb1176e2504fcffaa9f214e6aac7177e0
SHA512ba67a7b89430f0641938eec315001878d37d704341915d2fd06949fb6183f4989be16054a980488ec25d1aa328962bad163b2ef584526533ff872c31cfa833eb
-
C:\clover\CloverPortable\App\Clover\login_ui.dllMD5
e1475455e203479d38a4820389d9fe7e
SHA1ff7739f5edc2f821cdec5ecef0792c9b46271ee6
SHA25600e3be53d7b4aaa41d62f52ecdf21034444e98bd1c864d3ae265a64f40e3d3ed
SHA512b93826c0543cc0b38c679cfea1a96d5e58bcbb1e7999fdf7b501db28e9e7c5b552a37899784a53567164d61e1859c0227e55d9f0885a877f26845ea823eeb244
-
C:\clover\CloverPortable\App\DefaultData\config.iniMD5
a2c747624984d18bab5b68862895f7e9
SHA14628896a7690591667ea2cbfe4c97424e4d9e996
SHA256deab39ae9f51231caf91585f9310f599eecb0933d8b3075bab9f4b12ad270b45
SHA5122f324321f55ff245a3daf81d1d7068bdfcf7ee3e01a8a3528c7ad9b30f398d23c8e05048a755fd916e00691107ea269c63a5d964811777437cec9142663b9bcf
-
C:\clover\CloverPortable\CloverPortable.exeMD5
b3f430a233fa273f0554fdbc1743fbeb
SHA15ba152852ea1756afd0363d851df985059c17997
SHA25669ee78a5f75592ca942ad0be3880004466f7f55942a09d03a4161f3fba99a909
SHA5126100ce0f4deba7cf3d278bea4fe20f2e881e8faff2f688a8747f6b68345c08f0dd4313bdfcdded2651d65c4dbb01322580f6c8325d7478d23efaefc14a0487d3
-
C:\clover\CloverPortable\CloverPortable.exeMD5
b3f430a233fa273f0554fdbc1743fbeb
SHA15ba152852ea1756afd0363d851df985059c17997
SHA25669ee78a5f75592ca942ad0be3880004466f7f55942a09d03a4161f3fba99a909
SHA5126100ce0f4deba7cf3d278bea4fe20f2e881e8faff2f688a8747f6b68345c08f0dd4313bdfcdded2651d65c4dbb01322580f6c8325d7478d23efaefc14a0487d3
-
\Users\Admin\AppData\Local\Temp\nsc8082.tmp\FindProcDLL.dllMD5
ba4c1dfe226d573d516c0529f263011e
SHA1d726e947633ea75c09bba1cb6a14a79ce953be24
SHA2562ffe1ac2555e822b4a383996168031e456f09f9cf3bb763fccee35be178cf58a
SHA51273d607f0cc27eb3b1966911edf669417249bbcaa2d07f037cb3d3d3eaf368110e7e683d0e2186b06820302cd17041d5f60adab1d0ad0ebc03e34075cea37f5f8
-
\Users\Admin\AppData\Local\Temp\nsc8082.tmp\LangDLL.dllMD5
3dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
\Users\Admin\AppData\Local\Temp\nsc8082.tmp\System.dllMD5
75ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
\Users\Admin\AppData\Local\Temp\nsc8082.tmp\System.dllMD5
75ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
\Users\Admin\AppData\Local\Temp\nsc8082.tmp\nsDialogs.dllMD5
ca95c9da8cef7062813b989ab9486201
SHA1c555af25df3de51aa18d487d47408d5245dba2d1
SHA256feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
SHA512a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
-
\Users\Admin\AppData\Local\Temp\nsc8082.tmp\w7tbp.dllMD5
9a3031cc4cef0dba236a28eecdf0afb5
SHA1708a76aa56f77f1b0ebc62b023163c2e0426f3ac
SHA25653bb519e3293164947ac7cbd7e612f637d77a7b863e3534ba1a7e39b350d3c00
SHA5128fddde526e7d10d77e247ea80b273beae9dde1d4112806f1f5c3e6a409247d54d8a4445ab5bdd77025a434c3d1dcfdf480dac21abbdb13a308d5eb74517fab53
-
\Users\Admin\AppData\Local\Temp\nspB72D.tmp\System.dllMD5
bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
\Users\Admin\AppData\Local\Temp\nspB72D.tmp\UAC.dllMD5
a88baad3461d2e9928a15753b1d93fd7
SHA1bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA256c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
SHA5125edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
-
\Users\Admin\AppData\Local\Temp\nspB72D.tmp\nsExec.dllMD5
132e6153717a7f9710dcea4536f364cd
SHA1e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA256d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
SHA5129aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
-
\Users\Admin\AppData\Local\Temp\nspB72D.tmp\registry.dllMD5
2880bf3bbbc8dcaeb4367df8a30f01a8
SHA1cb5c65eae4ae923514a67c95ada2d33b0c3f2118
SHA256acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
SHA512ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
-
\Users\Admin\AppData\Local\Temp\nspB72D.tmp\registry.dllMD5
2880bf3bbbc8dcaeb4367df8a30f01a8
SHA1cb5c65eae4ae923514a67c95ada2d33b0c3f2118
SHA256acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
SHA512ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
-
\clover\CloverPortable\App\Clover\TabHelper64.dllMD5
643d2b4e7c1c0b8b01d2fd41a924af80
SHA164a8665c98c4af9c97e8d937994c0a5bcd73d221
SHA256e02c54b4f65d73b90a009e404464061e5f08be962f8268a79431b9683678e5ac
SHA5123c31370ac2a75465dd2c4de635a5d18be8d8c6ac4055398dd4b05d5b9566de3ff9518dcc3c893326d388ed9b4985d0553cb01c94b6aaa145eb0c6429097f1061
-
\clover\CloverPortable\App\Clover\TabHelper64.dllMD5
643d2b4e7c1c0b8b01d2fd41a924af80
SHA164a8665c98c4af9c97e8d937994c0a5bcd73d221
SHA256e02c54b4f65d73b90a009e404464061e5f08be962f8268a79431b9683678e5ac
SHA5123c31370ac2a75465dd2c4de635a5d18be8d8c6ac4055398dd4b05d5b9566de3ff9518dcc3c893326d388ed9b4985d0553cb01c94b6aaa145eb0c6429097f1061
-
\clover\CloverPortable\App\Clover\TabHelper64.dllMD5
643d2b4e7c1c0b8b01d2fd41a924af80
SHA164a8665c98c4af9c97e8d937994c0a5bcd73d221
SHA256e02c54b4f65d73b90a009e404464061e5f08be962f8268a79431b9683678e5ac
SHA5123c31370ac2a75465dd2c4de635a5d18be8d8c6ac4055398dd4b05d5b9566de3ff9518dcc3c893326d388ed9b4985d0553cb01c94b6aaa145eb0c6429097f1061
-
\clover\CloverPortable\App\Clover\UtilWnd.dllMD5
a72206185fa4e7d05445fc26658541ff
SHA189a3140230ab3dec3e49aa6a5017f869049242c1
SHA256bb88206baf5fdc39cc1460ec253d14ed1b18acc16ef94b7610d074069267b0e3
SHA512414b8a2832346b53579be13185870a3ffd1a3c09a9b40ec3ff956c5211af47061fabab14a40545c62794fad5993048fd3190a59de1279e0c2f3e786659b3a9c0
-
\clover\CloverPortable\App\Clover\clover_dll.dllMD5
b4f7eae217bb80fdab69e7f87917dbb8
SHA15729c7c9c249699112fb125de3acc8040ac7b288
SHA25642066fa459f09670b73545010dd9f3fd1227d4468a76d8d524e2ab4eee7c0b4a
SHA51279dafae8d4fb6121988d598f27bf8135bc0180a78b39b2ebae8a82dfe67d78dd48b6fb9e23314553af577167c64e4c4b8edf8503fd3db305fe47e48b2fdb8a06
-
\clover\CloverPortable\App\Clover\login_ui.dllMD5
e1475455e203479d38a4820389d9fe7e
SHA1ff7739f5edc2f821cdec5ecef0792c9b46271ee6
SHA25600e3be53d7b4aaa41d62f52ecdf21034444e98bd1c864d3ae265a64f40e3d3ed
SHA512b93826c0543cc0b38c679cfea1a96d5e58bcbb1e7999fdf7b501db28e9e7c5b552a37899784a53567164d61e1859c0227e55d9f0885a877f26845ea823eeb244
-
memory/1360-138-0x0000000000000000-mapping.dmp
-
memory/2212-132-0x0000000000000000-mapping.dmp
-
memory/2392-135-0x0000000000000000-mapping.dmp
-
memory/3256-129-0x0000000005010000-0x0000000005073000-memory.dmpFilesize
396KB