Windows Analysis Report
AlphaDecrypter.exe

Overview

General Information

Sample name: AlphaDecrypter.exe
Analysis ID: 1532908
MD5: 61f559e667a8a8baa99aa9d81d2afbc0
SHA1: c0d3114ab855a79e4ad229b8a6e253e1b2db2e64
SHA256: 05c1d10a8d9dd898f7e601a6032284814a640f5fa44e5fc380c17cbbe8940cd5
Tags: exeuser-bicboi
Infos:

Detection

Score: 36
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Malicious sample detected (through community Yara rule)
Allocates memory with a write watch (potentially for evading sandboxes)
Detected potential crypto function
Potential key logger detected (key state polling based)
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Uses 32bit PE files
Source: AlphaDecrypter.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: AlphaDecrypter.exe Static PE information: certificate valid
Source: AlphaDecrypter.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: AlphaDecrypter.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AlphaDecrypter.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AlphaDecrypter.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: AlphaDecrypter.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: AlphaDecrypter.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AlphaDecrypter.exe String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AlphaDecrypter.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AlphaDecrypter.exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AlphaDecrypter.exe String found in binary or memory: http://ocsp.comodoca.com0
Source: AlphaDecrypter.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: AlphaDecrypter.exe String found in binary or memory: http://ocsp.digicert.com0O
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/demonslay335
Source: AlphaDecrypter.exe, 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://twitter.com/demonslay335Ghttps://twitter.com/malwrhunterteam=https://twitter.com/hahn_katja9
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/hahn_katja
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/malwrhunterteam
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/siri_urz
Source: AlphaDecrypter.exe String found in binary or memory: https://www.digicert.com/CPS0
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A11D359 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState, 0_2_0A11D359

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.AlphaDecrypter.exe.5830000.0.unpack, type: UNPACKEDPE Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Source: 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Source: 00000000.00000002.3033498403.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Source: 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Detected potential crypto function
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_01660868 0_2_01660868
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_016614E2 0_2_016614E2
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A11A6D0 0_2_0A11A6D0
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A11B518 0_2_0A11B518
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A11B518 0_2_0A11B518
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A11A6D0 0_2_0A11A6D0
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A110670 0_2_0A110670
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_0A110667 0_2_0A110667
Sample file is different than original file name gathered from version info
Source: AlphaDecrypter.exe, 00000000.00000002.3033498403.000000000167E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs AlphaDecrypter.exe
Uses 32bit PE files
Source: AlphaDecrypter.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Yara signature match
Source: 0.2.AlphaDecrypter.exe.5830000.0.unpack, type: UNPACKEDPE Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: 00000000.00000002.3033498403.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: AlphaDecrypter.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: sus36.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Mutant created: NULL
Source: AlphaDecrypter.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AlphaDecrypter.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\AlphaDecrypter.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: AlphaDecrypter.exe Static PE information: certificate valid
Source: AlphaDecrypter.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: AlphaDecrypter.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Code function: 0_2_016669EA push ecx; retf FFEDh 0_2_01666A0C
Source: AlphaDecrypter.exe Static PE information: section name: .text entropy: 7.62629055697075
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 1640000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 3300000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 5300000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 5A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 6A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 6B80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: 7B80000 memory reserve | memory write watch Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Users\user\Desktop\AlphaDecrypter.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1532908 Sample: AlphaDecrypter.exe Startdate: 14/10/2024 Architecture: WINDOWS Score: 36 7 Malicious sample detected (through community Yara rule) 2->7 5 AlphaDecrypter.exe 2 2->5         started        process3
⊘No contacted IP infos