Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2023-08-07 12:04:18.619040	2023-08-07 12:04:58.131077	39 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2023-08-07 12:04:19	2023-08-07 12:04:57

File Details

File name	9b6b66be6b576fe03f5d47fa237f159aeeafed37.exe
File size	10332864 bytes
File type	PE32+ executable (GUI) x86-64, for MS Windows
CRC32	432F1C9A
MD5	a7bc6c38131209d31797b3e3b27dcf8c
SHA1	9b6b66be6b576fe03f5d47fa237f159aeeafed37
SHA256	41dd2a6eed0388241bff7bd4be3b891703c5d612622a3ddad46f8768d6609c38
SHA512	17ec314e0d46f1fad2c55daa34a0fe52dbf0d922b27101e87cff3c82e21c8c2a882273d3ca53b92915a1ad687d9a2de3e735f88e5e905b4a39ac37726c8cedcc
Ssdeep	None
PEiD	None matched
Yara	DebuggerCheck__QueryInfo () Check_OutputDebugStringA_iat () anti_dbg (Checks if being debugged) contains_base64 (This rule finds for base64 strings) escalate_priv (Escalade priviledges) screenshot (Take screenshot) win_registry (Affect system registries) win_token (Affect system token) win_files_operation (Affect private profile) Str_Win32_Http_API (Match Windows Http API call) Big_Numbers1 (Looks for big numbers 32:sized) Big_Numbers2 (Looks for big numbers 48:sized) CRC32_poly_Constant (Look for CRC32 [poly]) CRC32_table (Look for CRC32 table) MD5_Constants (Look for MD5 constants) SHA2_BLAKE2_IVs (Look for SHA2/BLAKE2/Argon2 IVs) BASE64_table (Look for Base64 table) IsPE64 () IsWindowsGUI () IsPacked (Entropy Check) HasOverlay (Overlay Check) HasDebugData (DebugData Check) HasRichSignature (Rich Signature Check) Microsoft_Visual_Cpp_80_DLL () Antivirus (Contains references to security software) VM_Generic_Detection (Tries to detect virtualized environments) Dropper_Strings (May have dropper capabilities)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=75, Anomalies=0, PEiD=0, Yara=0, VT[1691424325]=0): Snort Events=0, AV Events=0
Total Score=75

Signatures

recon_fingerprint details

has_pdb details

antivm_memory_available details

pe_features details

raises_exception details

nolookup_communication details

antivm_disk_size details

antivm_network_adapters details

antiav_detectfile details

antiav_detectreg details

antisandbox_idletime details

antivm_generic_disk details

exploit_heapspray details

antivm_firmware details

Screenshots

No screenshots available.

Static Analysis

Version Infos

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0010ccec	0x0010ce00	6.45200083135
.rdata	0x0010e000	0x00043926	0x00043a00	5.5840887007
.data	0x00152000	0x0000a358	0x00005a00	4.39244592226
.pdata	0x0015d000	0x0000be44	0x0000c000	6.08102207737
.didat	0x00169000	0x00000448	0x00000600	2.81976471886
_RDATA	0x0016a000	0x0000015c	0x00000200	3.35130077443
.rsrc	0x0016b000	0x00017800	0x00017800	6.26518514451
.reloc	0x00183000	0x0000141c	0x00001600	5.24359344764

Resources

Name	Offset	Size	Language	Sub-language	File type
FILE	0x00174c28	0x000013b0	LANG_CZECH	SUBLANG_DEFAULT	GIF image data, version 89a, 420 x 150
FILE	0x00174c28	0x000013b0	LANG_CZECH	SUBLANG_DEFAULT	GIF image data, version 89a, 420 x 150
FILE	0x00174c28	0x000013b0	LANG_CZECH	SUBLANG_DEFAULT	GIF image data, version 89a, 420 x 150
FILE	0x00174c28	0x000013b0	LANG_CZECH	SUBLANG_DEFAULT	GIF image data, version 89a, 420 x 150
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_ICON	0x00181b80	0x00000468	LANG_NEUTRAL	SUBLANG_NEUTRAL	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x00181fe8	0x00000084	LANG_NEUTRAL	SUBLANG_NEUTRAL	MS Windows icon resource - 9 icons, 48x48, 256-colors
RT_VERSION	0x00182070	0x00000324	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_MANIFEST	0x00182398	0x00000466	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators

Imports

Library dwmapi.dll:

• 0x14010e640 - DwmSetWindowAttribute

Library ntdll.dll:

• 0x14010e650 - RtlVirtualUnwind

• 0x14010e658 - RtlNtStatusToDosError

• 0x14010e660 - NtClose

• 0x14010e668 - VerSetConditionMask

• 0x14010e670 - NtOpenKey

• 0x14010e678 - NtQueryKey

• 0x14010e680 - NtDeleteKey

• 0x14010e688 - RtlPcToFileHeader

• 0x14010e690 - RtlCaptureContext

• 0x14010e698 - RtlLookupFunctionEntry

• 0x14010e6a0 - RtlUnwindEx

• 0x14010e6a8 - RtlUnwind

Library KERNEL32.dll:

• 0x14010e000 - VirtualFree

• 0x14010e008 - GetCommandLineA

• 0x14010e010 - GetOEMCP

• 0x14010e018 - GetACP

• 0x14010e020 - IsValidCodePage

• 0x14010e028 - GetTimeZoneInformation

• 0x14010e030 - EnumSystemLocalesW

• 0x14010e038 - IsValidLocale

• 0x14010e040 - LCMapStringW

• 0x14010e048 - GetConsoleOutputCP

• 0x14010e050 - ReadConsoleW

• 0x14010e058 - GetConsoleMode

• 0x14010e060 - ExitProcess

• 0x14010e068 - GetStdHandle

• 0x14010e070 - GetFileType

• 0x14010e078 - SetStdHandle

• 0x14010e080 - FreeLibraryAndExitThread

• 0x14010e088 - ExitThread

• 0x14010e090 - SystemTimeToFileTime

• 0x14010e098 - TzSpecificLocalTimeToSystemTime

• 0x14010e0a0 - InterlockedPushEntrySList

• 0x14010e0a8 - OutputDebugStringW

• 0x14010e0b0 - CloseHandle

• 0x14010e0b8 - SetLastError

• 0x14010e0c0 - GetLastError

• 0x14010e0c8 - CreateFileW

• 0x14010e0d0 - DeviceIoControl

• 0x14010e0d8 - FindClose

• 0x14010e0e0 - FindFirstFileW

• 0x14010e0e8 - RemoveDirectoryW

• 0x14010e0f0 - InitializeCriticalSection

• 0x14010e0f8 - DeleteCriticalSection

• 0x14010e100 - EnterCriticalSection

• 0x14010e108 - LeaveCriticalSection

• 0x14010e110 - WaitForSingleObject

• 0x14010e118 - GetProcAddress

• 0x14010e120 - GetModuleHandleW

• 0x14010e128 - HeapAlloc

• 0x14010e130 - GetProcessHeap

• 0x14010e138 - GetSystemDirectoryW

• 0x14010e140 - lstrcatW

• 0x14010e148 - GetModuleHandleA

• 0x14010e150 - LocalFree

• 0x14010e158 - CreateProcessW

• 0x14010e160 - CreateEventW

• 0x14010e168 - ResumeThread

• 0x14010e170 - GetExitCodeProcess

• 0x14010e178 - GetCurrentThread

• 0x14010e180 - GetCurrentProcess

• 0x14010e188 - FindResourceW

• 0x14010e190 - SizeofResource

• 0x14010e198 - LockResource

• 0x14010e1a0 - LoadResource

• 0x14010e1a8 - GlobalAlloc

• 0x14010e1b0 - GlobalLock

• 0x14010e1b8 - GlobalFree

• 0x14010e1c0 - GlobalUnlock

• 0x14010e1c8 - SetEvent

• 0x14010e1d0 - CreateThread

• 0x14010e1d8 - TerminateThread

• 0x14010e1e0 - GetLocaleInfoW

• 0x14010e1e8 - WideCharToMultiByte

• 0x14010e1f0 - MultiByteToWideChar

• 0x14010e1f8 - Sleep

• 0x14010e200 - GetCurrentThreadId

• 0x14010e208 - FreeLibrary

• 0x14010e210 - FileTimeToSystemTime

• 0x14010e218 - GetUserDefaultLangID

• 0x14010e220 - LoadLibraryA

• 0x14010e228 - GetCommandLineW

• 0x14010e230 - GetFileTime

• 0x14010e238 - GetCurrentProcessId

• 0x14010e240 - GetEnvironmentStringsW

• 0x14010e248 - FreeEnvironmentStringsW

• 0x14010e250 - GetSystemTimeAsFileTime

• 0x14010e258 - GetFileSizeEx

• 0x14010e260 - ReadFile

• 0x14010e268 - GetNativeSystemInfo

• 0x14010e270 - GetPrivateProfileStringW

• 0x14010e278 - IsProcessorFeaturePresent

• 0x14010e280 - HeapFree

• 0x14010e288 - InitializeCriticalSectionEx

• 0x14010e290 - LCIDToLocaleName

• 0x14010e298 - HeapSize

• 0x14010e2a0 - GetUserDefaultLCID

• 0x14010e2a8 - HeapReAlloc

• 0x14010e2b0 - DecodePointer

• 0x14010e2b8 - HeapDestroy

• 0x14010e2c0 - FormatMessageW

• 0x14010e2c8 - LoadLibraryExW

• 0x14010e2d0 - GetFileAttributesExW

• 0x14010e2d8 - CompareFileTime

• 0x14010e2e0 - TerminateProcess

• 0x14010e2e8 - GetModuleHandleExW

• 0x14010e2f0 - VerifyVersionInfoW

• 0x14010e2f8 - WaitForMultipleObjects

• 0x14010e300 - ResetEvent

• 0x14010e308 - GetModuleFileNameW

• 0x14010e310 - InitializeCriticalSectionAndSpinCount

• 0x14010e318 - RaiseException

• 0x14010e320 - GetTickCount

• 0x14010e328 - QueryPerformanceFrequency

• 0x14010e330 - QueryPerformanceCounter

• 0x14010e338 - CompareStringW

• 0x14010e340 - WriteFile

• 0x14010e348 - CreateToolhelp32Snapshot

• 0x14010e350 - Process32FirstW

• 0x14010e358 - Process32NextW

• 0x14010e360 - GetThreadId

• 0x14010e368 - FlushFileBuffers

• 0x14010e370 - DeleteFileW

• 0x14010e378 - GetFileInformationByHandle

• 0x14010e380 - GetFullPathNameW

• 0x14010e388 - OutputDebugStringA

• 0x14010e390 - TlsAlloc

• 0x14010e398 - TlsGetValue

• 0x14010e3a0 - TlsSetValue

• 0x14010e3a8 - CreateSemaphoreW

• 0x14010e3b0 - ReleaseSemaphore

• 0x14010e3b8 - GetSystemInfo

• 0x14010e3c0 - GetVersionExW

• 0x14010e3c8 - ExpandEnvironmentStringsW

• 0x14010e3d0 - GetShortPathNameW

• 0x14010e3d8 - GetFileAttributesW

• 0x14010e3e0 - GetWindowsDirectoryW

• 0x14010e3e8 - GetProcessAffinityMask

• 0x14010e3f0 - GetLongPathNameW

• 0x14010e3f8 - VirtualAlloc

• 0x14010e400 - VirtualProtect

• 0x14010e408 - GlobalMemoryStatusEx

• 0x14010e410 - GetExitCodeThread

• 0x14010e418 - TlsFree

• 0x14010e420 - SetFilePointer

• 0x14010e428 - SetFileAttributesW

• 0x14010e430 - GetFileSize

• 0x14010e438 - SetEndOfFile

• 0x14010e440 - MoveFileExW

• 0x14010e448 - LockFileEx

• 0x14010e450 - CreateFileMappingW

• 0x14010e458 - MapViewOfFile

• 0x14010e460 - UnmapViewOfFile

• 0x14010e468 - DuplicateHandle

• 0x14010e470 - SetFileTime

• 0x14010e478 - CreateDirectoryW

• 0x14010e480 - GetCurrentDirectoryW

• 0x14010e488 - FindFirstFileExW

• 0x14010e490 - FindNextFileW

• 0x14010e498 - QueryDosDeviceW

• 0x14010e4a0 - GetVolumePathNameW

• 0x14010e4a8 - GetVolumeNameForVolumeMountPointW

• 0x14010e4b0 - GetEnvironmentVariableW

• 0x14010e4b8 - GetVersion

• 0x14010e4c0 - FindResourceExW

• 0x14010e4c8 - SetEnvironmentVariableW

• 0x14010e4d0 - WriteProcessMemory

• 0x14010e4d8 - LoadLibraryW

• 0x14010e4e0 - UnlockFileEx

• 0x14010e4e8 - SetFilePointerEx

• 0x14010e4f0 - WriteConsoleW

• 0x14010e4f8 - CopyFileW

• 0x14010e500 - SetFileInformationByHandle

• 0x14010e508 - GetDiskFreeSpaceExW

• 0x14010e510 - FreeResource

• 0x14010e518 - K32GetMappedFileNameW

• 0x14010e520 - FindFirstVolumeW

• 0x14010e528 - FindNextVolumeW

• 0x14010e530 - GetVolumePathNamesForVolumeNameW

• 0x14010e538 - FindVolumeClose

• 0x14010e540 - VirtualQuery

• 0x14010e548 - GetSystemTimes

• 0x14010e550 - GetTickCount64

• 0x14010e558 - GetStartupInfoW

• 0x14010e560 - IsDebuggerPresent

• 0x14010e568 - InitializeSListHead

• 0x14010e570 - SetUnhandledExceptionFilter

• 0x14010e578 - UnhandledExceptionFilter

• 0x14010e580 - GetCPInfo

• 0x14010e588 - FlsFree

• 0x14010e590 - FlsSetValue

• 0x14010e598 - FlsGetValue

• 0x14010e5a0 - FlsAlloc

• 0x14010e5a8 - LCMapStringEx

• 0x14010e5b0 - EncodePointer

• 0x14010e5b8 - GetLocaleInfoEx

• 0x14010e5c0 - SleepConditionVariableSRW

• 0x14010e5c8 - WakeAllConditionVariable

• 0x14010e5d0 - WakeConditionVariable

• 0x14010e5d8 - LoadLibraryExA

• 0x14010e5e0 - WaitForSingleObjectEx

• 0x14010e5e8 - GetStringTypeW

• 0x14010e5f0 - InitializeSRWLock

• 0x14010e5f8 - ReleaseSRWLockExclusive

• 0x14010e600 - AcquireSRWLockExclusive

• 0x14010e608 - TryAcquireSRWLockExclusive

• 0x14010e610 - FormatMessageA

• 0x14010e618 - InitializeConditionVariable

Library RPCRT4.dll:

• 0x14010e628 - UuidFromStringW

• 0x14010e630 - RpcEpUnregister

Exports

Ordinal	Address	Name
1	0x14009e970	asw_process_storage_allocate_connector
2	0x14009e9a0	asw_process_storage_deallocate_connector
3	0x140090f20	on_avast_dll_unload
4	0x14009e770	onexit_register_connector_avast_2

Strings

Dropped Files

dc7aa321c05d9991_4a9377e7e528f7e56b69a81c500abc24

File name	dc7aa321c05d9991_4a9377e7e528f7e56b69a81c500abc24
File size	176 bytes
File type	data
MD5	d4a68eebbaf34d5e4fb0ad412b698f3a
SHA1	4994d4d3ea1b45dbe0e7028d1a23cdf4ac27c603
SHA256	dc7aa321c05d999148917dcea75e8ea30a83bf94409314e0c4440100b510b1dd
SHA512	d05b28cc39ddc9e1bc2b73f9f3a96e745d7c1fa4dd90acbba569694ec9658cfd15acc1bb358f42e32d97d0e5f82602156ff15ca4bb502f2ff88b4068782726bb
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

80e54212c1a1088b_servers.def.vpx

File name	80e54212c1a1088b_servers.def.vpx
File size	2454 bytes
File type	data
MD5	5c3fdff262b4d68a069fb507730410c6
SHA1	d955473e9c948cb94dfeb46a86623886b1878cef
SHA256	80e54212c1a1088bc238ca6499654c5318332d48e256a08460db939354b40c1c
SHA512	dcc64e0bdd3abd77eefc4cca26e831cc49101fecd6d2db2111ace60a8cdf975bd2a38b0e6de0c9cff43b2b003cef930f08ea9ba983613fc867a49b7c67fdf79f
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

dbeb33e5e95ec5f6_servers.def

File name	dbeb33e5e95ec5f6_servers.def
File size	30252 bytes
File type	ASCII text, with CRLF line terminators
MD5	9a11f6ee3b9663639715b3ea4b2971ea
SHA1	49a456336630ec902a49979435d6232145241d6a
SHA256	dbeb33e5e95ec5f6af7f21c54162034032166e558aefa1932df5a5676ccb5d98
SHA512	66a376fed10d16d099146db15e50d284f6e7595658980115896dd2362e2b1130dd875ef95ccbe75ed044d59fe45b425ef8e74c38f06ad9544f459f376a95fcba
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

b248c04ffc64746f_setup.log

File name	b248c04ffc64746f_setup.log
File size	1134 bytes
File type	UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5	22a3059f4de8d20832040902b842a726
SHA1	e18d8e270e016e512ac2a3b4873afe5da99e6f01
SHA256	b248c04ffc64746f245aa27a2eb20a821072da80e917ec888460cd7f7947d7a1
SHA512	a92c58f08ce7a10c604636e5a84b60751ebff8134cb04d9da8b59bd595b976156176cce3204d7e7473ec6b2e1075270c01b76f3d076b52edb26a5f51f37f7556
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

ebd41040e4bb3ec7_4a9377e7e528f7e56b69a81c500abc24

File name	ebd41040e4bb3ec7_4a9377e7e528f7e56b69a81c500abc24
File size	889 bytes
File type	data
MD5	3e455215095192e1b75d379fb187298a
SHA1	b1bc968bd4f49d622aa89a81f2150152a41d829c
SHA256	ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
SHA512	54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
216.239.32.29
216.239.36.178
23.49.100.177
34.117.223.223
70.186.27.9
8.252.43.254
8.8.8.8

DNS Requests

Domain	IP Address
armmf.adobe.com	23.73.128.222
dns.msftncsi.com	131.107.255.255
ctldl.windowsupdate.com	72.21.81.240
www.google-analytics.com	142.250.72.142
teredo.ipv6.microsoft.com	54.156.11.120
analytics.ff.avast.com	34.117.223.223
ipv6.msftncsi.com
pki.goog	216.239.32.29
v7event.stats.avast.com	34.117.223.223

HTTP Requests

URL	Data
http://pki.goog/gsr1/gsr1.crt	GET /gsr1/gsr1.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: pki.goog
http://www.google-analytics.com/collect?an=Free&av=23.7.8348&cd=stub-extended&cd3=Online&cid=8cdf43b5-6ebf-4a89-93ee-3b2c42d87730&dt=Installation&t=screenview&tid=UA-58120669-3&v=1	GET /collect?an=Free&av=23.7.8348&cd=stub-extended&cd3=Online&cid=8cdf43b5-6ebf-4a89-93ee-3b2c42d87730&dt=Installation&t=screenview&tid=UA-58120669-3&v=1 HTTP/1.1 Connection: Keep-Alive User-Agent: Avast SFX/1.0 Host: www.google-analytics.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Read

C:\Users\Harry Dresden\AppData\Local\Temp\9b6b66be6b576fe03f5d47fa237f159aeeafed37.exe
C:\Windows\Temp\asw.2fb6ac73f2fb1140\servers.def
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log.tmp.19f15228-8646-46a6-a9c5-c1a0a10e331f

File-Written

C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log.tmp.19f15228-8646-46a6-a9c5-c1a0a10e331f
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24
C:\Windows\Temp\asw.2fb6ac73f2fb1140\servers.def.vpx
C:\Windows\Temp\asw.2fb6ac73f2fb1140\servers.def
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

File-Opened

C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My
C:\Windows\Fonts\arial.ttf
C:\Windows\Temp\asw.2fb6ac73f2fb1140\servers.def.vpx
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users\Harry Dresden\AppData\Local\Temp\9b6b66be6b576fe03f5d47fa237f159aeeafed37.exe
C:\Windows\Fonts\ariali.ttf
C:\Windows\Fonts\arialbi.ttf
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Windows\Temp\asw.2fb6ac73f2fb1140\servers.def
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Users\Harry Dresden\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\Fonts\arialbd.ttf
\??\PhysicalDrive0
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\
C:\Users\Harry Dresden\AppData\LocalLow
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\

Directory-Created

C:\Windows\Temp\asw.2fb6ac73f2fb1140
\\.\C:\ProgramData\Avast Software
C:\
C:\ProgramData\Avast Software\Persistent Data\Avast\
C:\ProgramData\
C:\ProgramData\Avast Software\
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs
C:\ProgramData\Avast Software\Persistent Data\

Registry Key-Opened

HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0
HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
HKEY_LOCAL_MACHINE\Software\ALWIL Software\Avast\5.0
HKEY_LOCAL_MACHINE\Software\ALWIL Software\Avast
HKEY_CLASSES_ROOT\AvastPersistentStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Freedom Scientific\JAWS
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Avast Software
HKEY_LOCAL_MACHINE\SOFTWARE\XVision\Sense Reader
HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
HKEY_LOCAL_MACHINE\Software\ALWIL Software\Avast\4.0
HKEY_LOCAL_MACHINE\Software\AVAST Software\Avast
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NVDA

Registry Key-Read

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\Winsock\UseDelayedAcceptance
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseHostnameAsAlias
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB\Blob
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertLastSyncTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ShareCredsWithWinHttp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\RootDirUrl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertEncodedCtl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3416602863-1947377224-293699093-1003\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F18B538D1BE903B6A6F056435B171589CAF36BF2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Parameters\Transports
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SQMServiceList\SQMServiceList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\LastSyncTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartyFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAAllFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadOverride
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\2023
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SecurityProviders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\FirstEntry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\Comment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\LdapClientIntegrity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.1!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\Winsock\HelperDllName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\Tcpip6\WinSock 2.0 Provider ID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Winsock\Mapping
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Winsock\UseDelayedAcceptance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LDAP\UseOldHostResolutionOrder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartySha256Allow
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\LsaExtensionConfig\SspiCli\CheckSignatureRoutine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Winsock\MinSockaddrLength
HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\Winsock\MinSockaddrLength
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\LsaExtensionConfig\SspiCli\CheckSignatureDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MinRsaPubKeyBitLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70\Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\DisableBranchCache
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\EncodedCtl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.2!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\Winsock\MaxSockaddrLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\LastEntry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\PageAllocatorSystemHeapIsPrivate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\Capabilities
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Winsock\HelperDllName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartyAfterTime
HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\TokenSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\PageAllocatorUseSystemHeap
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Winsock\MaxSockaddrLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\SyncDeltaTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\Flags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\RpcId
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxySettingsPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertSyncDeltaTime
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakDSAThirdPartyFlags
HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRsaPubKeyTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\Tcpip\WinSock 2.0 Provider ID
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\Winsock\Mapping
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll\Version
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST\2007

Registry Key-Written

HKEY_CURRENT_USER\Local Settings\MuiCache\4A\52C64B7E\LanguageList
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avast Software\SymbolicLinkValue

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Users\Harry Dresden\AppData\Local\Temp\9b6b66be6b576fe03f5d47fa237f159aeeafed37.exe" PID: 2476, Parent PID: 1312

Volatility

Nothing to display.

LegalCopyright:	Copyright (c) 2023 AVAST Software
InternalName:	SfxInst
FileVersion:	23.7.8348.0
CompanyName:	AVAST Software
ProductName:	Avast Antivirus
ProductVersion:	23.7.8348.0
FileDescription:	Avast Antivirus
OriginalFilename:	SfxInst.exe
ProductId:	avast-av
Translation:	0x0409 0x04b0