File name:

butterflyondesktop.exe

Full analysis: https://app.any.run/tasks/92b3dfd2-b3c5-459e-aba8-05e121d3a0ef
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 13, 2024, 02:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1535AA21451192109B86BE9BCC7C4345

SHA1:

1AF211C686C4D4BF0239ED6620358A19691CF88C

SHA256:

4641AF6A0071E11E13AD3B1CD950E01300542C2B9EFB6AE92FFECEDDE974A4A6

SSDEEP:

49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.exe (PID: 1776)
      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.tmp (PID: 3428)
      • livecamwallpaper.exe (PID: 2328)
      • freeclock.exe (PID: 764)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • ataclock.exe (PID: 2736)
      • ataclock.exe (PID: 2940)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Changes the autorun value in the registry

      • butterflyondesktop.tmp (PID: 2964)
      • LivecamWallpaper.exe (PID: 1196)
      • livecamwallpaper.tmp (PID: 3428)
      • FreeDesktopClock.exe (PID: 3968)

    • Starts NET.EXE for service management

      • freeclock.tmp (PID: 3760)
      • net.exe (PID: 3196)
      • net.exe (PID: 4020)
      • net.exe (PID: 2028)
      • ataclock.tmp (PID: 1168)
      • net.exe (PID: 2136)
      • ataclock.tmp (PID: 2532)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.exe (PID: 1776)
      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.exe (PID: 2328)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.exe (PID: 764)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • ataclock.exe (PID: 2736)
      • ataclock.exe (PID: 2940)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Reads the Windows owner or organization settings

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 3760)
      • ataclock.tmp (PID: 1168)
      • ataclock.tmp (PID: 2532)

    • Process drops legitimate windows executable

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 3760)
      • ataclock.tmp (PID: 1168)
      • ataclock.tmp (PID: 2532)

    • Reads the Internet Settings

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • FreeDesktopClock.exe (PID: 2740)
      • freeclock.tmp (PID: 2384)

    • Reads security settings of Internet Explorer

      • FreeDesktopClock.exe (PID: 2740)

    • Executes as Windows Service

      • timeserv.exe (PID: 1380)

    • Cleans NTFS data stream (Zone Identifier)

      • msedge.exe (PID: 3684)

  • INFO

    • Checks supported languages

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.tmp (PID: 3864)
      • butterflyondesktop.exe (PID: 1776)
      • butterflyondesktop.tmp (PID: 2964)
      • ButterflyOnDesktop.exe (PID: 2340)
      • livecamwallpaper.tmp (PID: 2756)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.tmp (PID: 3428)
      • LivecamWallpaper.exe (PID: 1196)
      • freeclock.exe (PID: 764)
      • freeclock.tmp (PID: 2384)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • livecamwallpaper.exe (PID: 2328)
      • FreeDesktopClock.exe (PID: 2740)
      • timeserv.exe (PID: 1344)
      • timeserv.exe (PID: 1380)
      • FreeDesktopClock.exe (PID: 3968)
      • ataclock.exe (PID: 2736)
      • ataclock.tmp (PID: 948)
      • ataclock.exe (PID: 2940)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.tmp (PID: 3964)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Reads the computer name

      • butterflyondesktop.tmp (PID: 3864)
      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 2756)
      • LivecamWallpaper.exe (PID: 1196)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 2384)
      • freeclock.tmp (PID: 3760)
      • FreeDesktopClock.exe (PID: 2740)
      • timeserv.exe (PID: 1344)
      • FreeDesktopClock.exe (PID: 3968)
      • ataclock.tmp (PID: 948)
      • ataclock.tmp (PID: 3964)
      • ataclock.tmp (PID: 1168)
      • ataclock.tmp (PID: 2532)
      • timeserv.exe (PID: 1380)

    • Create files in a temporary directory

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.exe (PID: 1776)
      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.exe (PID: 2328)
      • freeclock.exe (PID: 764)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • livecamwallpaper.tmp (PID: 3428)
      • ataclock.exe (PID: 2736)
      • ataclock.exe (PID: 2940)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Creates a software uninstall entry

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 3760)

    • Creates files in the program directory

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • ataclock.tmp (PID: 2532)
      • freeclock.tmp (PID: 3760)

    • Application launched itself

      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 3500)
      • msedge.exe (PID: 3024)
      • msedge.exe (PID: 2496)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 2888)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 2888)

    • The process uses the downloaded file

      • msedge.exe (PID: 3256)
      • msedge.exe (PID: 2832)
      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 4044)

    • Manual execution by a user

      • msedge.exe (PID: 3684)

    • Creates files or folders in the user directory

      • LivecamWallpaper.exe (PID: 1196)
      • FreeDesktopClock.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Drive Software Company
FileDescription: Butterfly on Desktop Setup
FileVersion:
LegalCopyright:
ProductName: Butterfly on Desktop
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
104
Malicious processes
14
Suspicious processes
5

Behavior graph

Click at the process to see the details
start butterflyondesktop.exe butterflyondesktop.tmp no specs butterflyondesktop.exe butterflyondesktop.tmp butterflyondesktop.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs livecamwallpaper.exe livecamwallpaper.tmp no specs livecamwallpaper.exe livecamwallpaper.tmp livecamwallpaper.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs freeclock.exe freeclock.tmp no specs freeclock.exe freeclock.tmp net.exe no specs net1.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs freedesktopclock.exe no specs timeserv.exe no specs net.exe no specs net1.exe no specs timeserv.exe no specs freedesktopclock.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ataclock.exe ataclock.tmp no specs ataclock.exe ataclock.tmp net.exe no specs net1.exe no specs ataclock.exe ataclock.tmp no specs ataclock.exe ataclock.tmp net.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3756 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
560"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=5480 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
764"C:\Users\admin\Downloads\freeclock.exe" C:\Users\admin\Downloads\freeclock.exe
msedge.exe
User:
admin
Company:
Drive Software Company
Integrity Level:
MEDIUM
Description:
Free Desktop Clock Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\freeclock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
784"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2172 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
848"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4228 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
948"C:\Users\admin\AppData\Local\Temp\is-D16EJ.tmp\ataclock.tmp" /SL5="$60344,5754281,56832,C:\Users\admin\Downloads\ataclock.exe" C:\Users\admin\AppData\Local\Temp\is-D16EJ.tmp\ataclock.tmp—ataclock.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-d16ej.tmp\ataclock.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1000"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5812 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2316 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1040"C:\Users\admin\Downloads\freeclock.exe" /SPAWNWND=$70200 /NOTIFYWND=$A01D0 C:\Users\admin\Downloads\freeclock.exe
freeclock.tmp
User:
admin
Company:
Drive Software Company
Integrity Level:
HIGH
Description:
Free Desktop Clock Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\freeclock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1056"C:\Users\admin\Downloads\ataclock.exe" /SPAWNWND=$60332 /NOTIFYWND=$6031A C:\Users\admin\Downloads\ataclock.exe
ataclock.tmp
User:
admin
Company:
Drive Software Company
Integrity Level:
HIGH
Description:
Atomic Alarm Clock Installation File
Exit code:
0
Version:
6.3
Modules
Images
c:\users\admin\downloads\ataclock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
38 368
Read events
38 114
Write events
227
Delete events
27

Modification events

(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ButterflyOnDesktop
Value:
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.4.2 (a)
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Butterfly on Desktop
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Butterfly on Desktop\
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Butterfly on Desktop
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
butterflyondesktop
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Language
Value:
eng
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:DisplayName
Value:
Butterfly on Desktop 1.0
Executable files
117
Suspicious files
155
Text files
1 717
Unknown types
318

Dropped files

PID
Process
Filename
Type
3668butterflyondesktop.exeC:\Users\admin\AppData\Local\Temp\is-SIMGE.tmp\butterflyondesktop.tmpexecutable
MD5:C765336F0DCF4EFDCC2101EED67CD30C
SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28
1776butterflyondesktop.exeC:\Users\admin\AppData\Local\Temp\is-62JAS.tmp\butterflyondesktop.tmpexecutable
MD5:C765336F0DCF4EFDCC2101EED67CD30C
SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\is-ACFJQ.tmptext
MD5:F68621DA9CCBE320AEBB5807C6F733CB
SHA256:0479A712A54ADA76EAF0BC5F3B57C764880D1540CBE266724D35C4DCBF40E4E2
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\is-8VR4L.tmpexecutable
MD5:81AAB57E0EF37DDFF02D0106CED6B91E
SHA256:A70F9E100DDDB177F68EE7339B327A20CD9289FAE09DCDCE3DBCBC3E86756287
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\unins000.datbinary
MD5:F2747393D8C7B4C31F3D6DB5753025D3
SHA256:CD66501E7109BD31154643B8E5F48B5D92BE51401FD1CE00E3D09394EF1C40D0
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\unins000.exeexecutable
MD5:1FEE4DB19D9F5AF7834EC556311E69DD
SHA256:3D550C908D5A8DE143C5CD5F4FE431528CD5FA20B77F4605A9B8CA063E83FC36
3500msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:DF0BCCD68449F07F531D76F53C718178
SHA256:12025F4DA9E53A8B91892D4F6E6A9B89513F3488BFE9F1EEEC3C05F7EF96BDD8
2184msedge.exe —
MD5:—
SHA256:—
2964butterflyondesktop.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Butterfly on Desktop\Uninstall Butterfly on Desktop.lnkbinary
MD5:3E99159322141B158C7BFA36557C29B1
SHA256:0EB23DEBBCAECC062333BEB1C57013DB4DEAD9013E3B1B9C4F553C878E12E8E9
2964butterflyondesktop.tmpC:\Users\admin\Desktop\Butterfly on Desktop.lnkbinary
MD5:CB696D076B9B0A80161F55E2DD8B4CD7
SHA256:6B572F2CD8C0624DF85B0E939AC197884F0F0408E57BF4A886E6E489755486A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
92
TCP/UDP connections
201
DNS requests
174
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/butterflyondesktoplike.html
unknown
html
6.04 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/button.css
unknown
text
2.71 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/slider/slider.js
unknown
text
3.00 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/menubackground2.jpg
unknown
image
16.4 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/superman_likeus.gif
unknown
image
30.8 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/bodybackground.png
unknown
image
11.6 Kb
unknown
2888
msedge.exe
GET
301
157.240.0.6:80
http://connect.facebook.net/en_US/all.js
unknown
—
—
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/banner_bg2.jpg
unknown
image
2.50 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/banner3.jpg
unknown
image
41.3 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/index.html
unknown
html
31.4 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3684
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2888
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2888
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2888
msedge.exe
78.46.117.95:80
freedesktopsoft.com
Hetzner Online GmbH
DE
unknown
2888
msedge.exe
172.217.23.98:443
pagead2.googlesyndication.com
—
—
whitelisted
2888
msedge.exe
157.240.0.6:443
connect.facebook.net
—
—
unknown
2888
msedge.exe
142.250.186.130:443
googleads.g.doubleclick.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
freedesktopsoft.com
  • 78.46.117.95
malicious
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
pagead2.googlesyndication.com
  • 172.217.23.98
whitelisted
www.google-analytics.com
  • 142.250.184.206
whitelisted
connect.facebook.net
  • 157.240.0.6
whitelisted
googleads.g.doubleclick.net
  • 142.250.186.130
whitelisted
www.bing.com
  • 23.36.79.19
  • 23.36.79.25
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.130
  • 2.19.80.27
  • 2.19.80.89
  • 2.19.96.128
  • 2.19.96.107
whitelisted
fundingchoicesmessages.google.com
  • 142.250.186.110
whitelisted
fonts.googleapis.com
  • 142.250.185.74
  • 142.250.186.138
whitelisted

Threats

PID
Process
Class
Message
2888
msedge.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2888
msedge.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2888
msedge.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
msedge.exe
[0213/025406.799:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
butterflyondesktop.exe