File name:

butterflyondesktop.exe

Full analysis: https://app.any.run/tasks/92b3dfd2-b3c5-459e-aba8-05e121d3a0ef
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 13, 2024, 02:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1535AA21451192109B86BE9BCC7C4345

SHA1:

1AF211C686C4D4BF0239ED6620358A19691CF88C

SHA256:

4641AF6A0071E11E13AD3B1CD950E01300542C2B9EFB6AE92FFECEDDE974A4A6

SSDEEP:

49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.tmp (PID: 2964)
      • butterflyondesktop.exe (PID: 1776)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.exe (PID: 2328)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.exe (PID: 764)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • ataclock.exe (PID: 2736)
      • ataclock.exe (PID: 2940)
      • ataclock.exe (PID: 3732)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Changes the autorun value in the registry

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • LivecamWallpaper.exe (PID: 1196)
      • FreeDesktopClock.exe (PID: 3968)

    • Starts NET.EXE for service management

      • net.exe (PID: 3196)
      • net.exe (PID: 4020)
      • ataclock.tmp (PID: 1168)
      • net.exe (PID: 2028)
      • freeclock.tmp (PID: 3760)
      • net.exe (PID: 2136)
      • ataclock.tmp (PID: 2532)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 3760)
      • ataclock.tmp (PID: 1168)
      • ataclock.tmp (PID: 2532)

    • Executable content was dropped or overwritten

      • butterflyondesktop.tmp (PID: 2964)
      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.exe (PID: 1776)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.tmp (PID: 3428)
      • livecamwallpaper.exe (PID: 2328)
      • freeclock.exe (PID: 764)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • ataclock.exe (PID: 2736)
      • ataclock.exe (PID: 2940)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Process drops legitimate windows executable

      • butterflyondesktop.tmp (PID: 2964)
      • freeclock.tmp (PID: 3760)
      • livecamwallpaper.tmp (PID: 3428)
      • ataclock.tmp (PID: 1168)
      • ataclock.tmp (PID: 2532)

    • Reads the Internet Settings

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • FreeDesktopClock.exe (PID: 2740)
      • freeclock.tmp (PID: 2384)

    • Reads security settings of Internet Explorer

      • FreeDesktopClock.exe (PID: 2740)

    • Executes as Windows Service

      • timeserv.exe (PID: 1380)

    • Cleans NTFS data stream (Zone Identifier)

      • msedge.exe (PID: 3684)

  • INFO

    • Create files in a temporary directory

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.tmp (PID: 2964)
      • butterflyondesktop.exe (PID: 1776)
      • livecamwallpaper.exe (PID: 2328)
      • livecamwallpaper.exe (PID: 2192)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.exe (PID: 764)
      • freeclock.exe (PID: 1040)
      • freeclock.tmp (PID: 3760)
      • ataclock.exe (PID: 2736)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.exe (PID: 2940)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 2532)

    • Checks supported languages

      • butterflyondesktop.exe (PID: 3668)
      • butterflyondesktop.tmp (PID: 3864)
      • ButterflyOnDesktop.exe (PID: 2340)
      • butterflyondesktop.exe (PID: 1776)
      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 2756)
      • livecamwallpaper.tmp (PID: 3428)
      • livecamwallpaper.exe (PID: 2328)
      • livecamwallpaper.exe (PID: 2192)
      • LivecamWallpaper.exe (PID: 1196)
      • freeclock.tmp (PID: 2384)
      • freeclock.exe (PID: 1040)
      • freeclock.exe (PID: 764)
      • freeclock.tmp (PID: 3760)
      • FreeDesktopClock.exe (PID: 2740)
      • timeserv.exe (PID: 1344)
      • timeserv.exe (PID: 1380)
      • FreeDesktopClock.exe (PID: 3968)
      • ataclock.exe (PID: 2736)
      • ataclock.tmp (PID: 948)
      • ataclock.exe (PID: 2940)
      • ataclock.tmp (PID: 1168)
      • ataclock.exe (PID: 3732)
      • ataclock.exe (PID: 1056)
      • ataclock.tmp (PID: 3964)
      • ataclock.tmp (PID: 2532)

    • Reads the computer name

      • butterflyondesktop.tmp (PID: 3864)
      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • livecamwallpaper.tmp (PID: 2756)
      • LivecamWallpaper.exe (PID: 1196)
      • freeclock.tmp (PID: 2384)
      • freeclock.tmp (PID: 3760)
      • FreeDesktopClock.exe (PID: 2740)
      • timeserv.exe (PID: 1344)
      • timeserv.exe (PID: 1380)
      • FreeDesktopClock.exe (PID: 3968)
      • ataclock.tmp (PID: 948)
      • ataclock.tmp (PID: 3964)
      • ataclock.tmp (PID: 1168)
      • ataclock.tmp (PID: 2532)

    • Creates a software uninstall entry

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 3760)

    • Creates files in the program directory

      • butterflyondesktop.tmp (PID: 2964)
      • livecamwallpaper.tmp (PID: 3428)
      • freeclock.tmp (PID: 3760)
      • ataclock.tmp (PID: 2532)

    • Manual execution by a user

      • msedge.exe (PID: 3684)

    • The process uses the downloaded file

      • msedge.exe (PID: 3256)
      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 2832)
      • msedge.exe (PID: 4044)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 2888)

    • Application launched itself

      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 3500)
      • msedge.exe (PID: 3024)
      • msedge.exe (PID: 2496)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3684)
      • msedge.exe (PID: 2888)

    • Creates files or folders in the user directory

      • LivecamWallpaper.exe (PID: 1196)
      • FreeDesktopClock.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Drive Software Company
FileDescription: Butterfly on Desktop Setup
FileVersion:
LegalCopyright:
ProductName: Butterfly on Desktop
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
104
Malicious processes
14
Suspicious processes
5

Behavior graph

Click at the process to see the details
start butterflyondesktop.exe butterflyondesktop.tmp no specs butterflyondesktop.exe butterflyondesktop.tmp butterflyondesktop.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs livecamwallpaper.exe livecamwallpaper.tmp no specs livecamwallpaper.exe livecamwallpaper.tmp livecamwallpaper.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs freeclock.exe freeclock.tmp no specs freeclock.exe freeclock.tmp net.exe no specs net1.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs freedesktopclock.exe no specs timeserv.exe no specs net.exe no specs net1.exe no specs timeserv.exe no specs freedesktopclock.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ataclock.exe ataclock.tmp no specs ataclock.exe ataclock.tmp net.exe no specs net1.exe no specs ataclock.exe ataclock.tmp no specs ataclock.exe ataclock.tmp net.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3756 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
560"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=5480 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
764"C:\Users\admin\Downloads\freeclock.exe" C:\Users\admin\Downloads\freeclock.exe
msedge.exe
User:
admin
Company:
Drive Software Company
Integrity Level:
MEDIUM
Description:
Free Desktop Clock Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\freeclock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
784"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2172 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
848"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4228 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
948"C:\Users\admin\AppData\Local\Temp\is-D16EJ.tmp\ataclock.tmp" /SL5="$60344,5754281,56832,C:\Users\admin\Downloads\ataclock.exe" C:\Users\admin\AppData\Local\Temp\is-D16EJ.tmp\ataclock.tmp—ataclock.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-d16ej.tmp\ataclock.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1000"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5812 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2316 --field-trial-handle=1348,i,10796739041020534445,2271218217749414137,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1040"C:\Users\admin\Downloads\freeclock.exe" /SPAWNWND=$70200 /NOTIFYWND=$A01D0 C:\Users\admin\Downloads\freeclock.exe
freeclock.tmp
User:
admin
Company:
Drive Software Company
Integrity Level:
HIGH
Description:
Free Desktop Clock Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\freeclock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1056"C:\Users\admin\Downloads\ataclock.exe" /SPAWNWND=$60332 /NOTIFYWND=$6031A C:\Users\admin\Downloads\ataclock.exe
ataclock.tmp
User:
admin
Company:
Drive Software Company
Integrity Level:
HIGH
Description:
Atomic Alarm Clock Installation File
Exit code:
0
Version:
6.3
Modules
Images
c:\users\admin\downloads\ataclock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
38 368
Read events
38 114
Write events
227
Delete events
27

Modification events

(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ButterflyOnDesktop
Value:
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.4.2 (a)
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Butterfly on Desktop
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Butterfly on Desktop\
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Butterfly on Desktop
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
butterflyondesktop
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:Inno Setup: Language
Value:
eng
(PID) Process:(2964) butterflyondesktop.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Butterfly on Desktop_is1
Operation:writeName:DisplayName
Value:
Butterfly on Desktop 1.0
Executable files
117
Suspicious files
155
Text files
1 717
Unknown types
318

Dropped files

PID
Process
Filename
Type
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\is-8VR4L.tmpexecutable
MD5:81AAB57E0EF37DDFF02D0106CED6B91E
SHA256:A70F9E100DDDB177F68EE7339B327A20CD9289FAE09DCDCE3DBCBC3E86756287
2964butterflyondesktop.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Butterfly on Desktop\Butterfly on Desktop.lnkbinary
MD5:0CD2BD2B1D43A0D28F7C9B7288503A03
SHA256:1832EF435315E198A0719F226276EC6F096703BBF94BDBD0A660D9D3E43F8693
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\ButterflyOnDesktop.exeexecutable
MD5:81AAB57E0EF37DDFF02D0106CED6B91E
SHA256:A70F9E100DDDB177F68EE7339B327A20CD9289FAE09DCDCE3DBCBC3E86756287
1776butterflyondesktop.exeC:\Users\admin\AppData\Local\Temp\is-62JAS.tmp\butterflyondesktop.tmpexecutable
MD5:C765336F0DCF4EFDCC2101EED67CD30C
SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28
2964butterflyondesktop.tmpC:\Users\admin\AppData\Local\Temp\is-3EVA8.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
3500msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
2964butterflyondesktop.tmpC:\Program Files\Butterfly on Desktop\is-Q0OVV.tmpexecutable
MD5:81AAB57E0EF37DDFF02D0106CED6B91E
SHA256:A70F9E100DDDB177F68EE7339B327A20CD9289FAE09DCDCE3DBCBC3E86756287
2184msedge.exe —
MD5:—
SHA256:—
2964butterflyondesktop.tmpC:\Users\admin\Desktop\Butterfly on Desktop.lnkbinary
MD5:CB696D076B9B0A80161F55E2DD8B4CD7
SHA256:6B572F2CD8C0624DF85B0E939AC197884F0F0408E57BF4A886E6E489755486A4
3500msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF182bae.TMPbinary
MD5:2E4F5B4F652DAFFD9C80C58770313C9C
SHA256:21BC9F7B1F0EC2B6DF8435AC271D31602B57FBE030AFAB94761F399CF3D9076E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
92
TCP/UDP connections
201
DNS requests
174
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/butterflyondesktoplike.html
unknown
html
6.04 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/slider/slider.css
unknown
text
6.40 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/superman_likeus.gif
unknown
image
30.8 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/button.css
unknown
text
2.71 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/main.css
unknown
text
4.15 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/banner3.jpg
unknown
image
41.3 Kb
unknown
2888
msedge.exe
GET
301
157.240.0.6:80
http://connect.facebook.net/en_US/all.js
unknown
—
—
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/slider/slider.js
unknown
text
3.00 Kb
unknown
2888
msedge.exe
GET
200
142.250.185.99:80
http://fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
unknown
binary
125 Kb
unknown
2888
msedge.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/menubackgroundside2.jpg
unknown
image
1.35 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3684
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2888
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2888
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2888
msedge.exe
78.46.117.95:80
freedesktopsoft.com
Hetzner Online GmbH
DE
unknown
2888
msedge.exe
172.217.23.98:443
pagead2.googlesyndication.com
—
—
whitelisted
2888
msedge.exe
157.240.0.6:443
connect.facebook.net
—
—
unknown
2888
msedge.exe
142.250.186.130:443
googleads.g.doubleclick.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
freedesktopsoft.com
  • 78.46.117.95
malicious
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
pagead2.googlesyndication.com
  • 172.217.23.98
whitelisted
www.google-analytics.com
  • 142.250.184.206
whitelisted
connect.facebook.net
  • 157.240.0.6
whitelisted
googleads.g.doubleclick.net
  • 142.250.186.130
whitelisted
www.bing.com
  • 23.36.79.19
  • 23.36.79.25
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.130
  • 2.19.80.27
  • 2.19.80.89
  • 2.19.96.128
  • 2.19.96.107
whitelisted
fundingchoicesmessages.google.com
  • 142.250.186.110
whitelisted
fonts.googleapis.com
  • 142.250.185.74
  • 142.250.186.138
whitelisted

Threats

PID
Process
Class
Message
2888
msedge.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2888
msedge.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2888
msedge.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
msedge.exe
[0213/025406.799:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
butterflyondesktop.exe