{
	"id": "ab6738b0-3e9d-4509-998a-c87e1b77fe32",
	"created_at": "2026-04-06T00:16:44.127652Z",
	"updated_at": "2026-04-10T03:20:55.629275Z",
	"deleted_at": null,
	"sha1_hash": "1758114555b373db35b628c8adc9fe39692e0f46",
	"title": "AppCertDlls",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 131000,
	"plain_text": "AppCertDlls\r\nArchived: 2026-04-05 16:48:00 UTC\r\nThe Wayback Machine -\r\nhttps://web.archive.org/web/20130401232752/http://forum.sysinternals.com:80/appcertdlls_topic12546.html\r\nAuthor\r\n  \r\n Topic Search   Topic Options\r\nEP_X0FF\r\nSenior Member\r\nJoined: 08 March 2006\r\nLocation: Russian Federation\r\nStatus: Offline\r\nPoints: 4753\r\n Post Options    Thanks(0)    Quote   Reply Topic: AppCertDlls\r\n    Posted: 24 October 2007 at 5:03am\r\nWhy Autoruns does not scans this key?\r\n\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls\r\nEdited by EP_X0FF - 24 October 2007 at 5:03am\r\n TonyKlein\r\nGroupie\r\nJoined: 13 June 2005\r\nLocation: Netherlands\r\nStatus: Offline\r\nPoints: 62\r\nhttps://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html\r\nPage 1 of 4\n\nPost Options    Thanks(0)    Quote   Reply Posted: 25 July 2010 at 10:48am\r\nI thought I'd bump this up,  as more and more malware has been observed to write to this key:\r\nhttp://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?\r\nName=TrojanSpy%3AWin32%2FUrsnif.gen!I\r\nhttp://www.avira.com/en/threats/section/fulldetails/id_vir/5324/tr_spy.browse.a.html\r\nhttp://www.threatexpert.com/report.aspx?md5=aa0ce626ac39dbdb728b82cbf4328907\r\n bootsect\r\nSenior Member\r\nJoined: 24 December 2009\r\nStatus: Offline\r\nhttps://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html\r\nPage 2 of 4\n\nPoints: 747\r\n Post Options    Thanks(0)    Quote   Reply Posted: 26 July 2010 at 11:47am\r\nNobody cares I guess.\r\n TonyKlein\r\nGroupie\r\nJoined: 13 June 2005\r\nLocation: Netherlands\r\nStatus: Offline\r\nPoints: 62\r\n Post Options    Thanks(0)    Quote   Reply Posted: 02 August 2010 at 12:17pm\r\nSome kind of answer would be nice, though...\r\n Mark\r\nAdmin Group\r\nJoined: 04 June 2005\r\nLocation: United States\r\nStatus: Offline\r\nPoints: 515\r\n Post Options    Thanks(0)    Quote   Reply Posted: 03 August 2010 at 5:20am\r\nGood suggestion, thanks.\r\n TonyKlein\r\nGroupie\r\nJoined: 13 June 2005\r\nLocation: Netherlands\r\nStatus: Offline\r\nPoints: 62\r\nhttps://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html\r\nPage 3 of 4\n\nPost Options    Thanks(0)    Quote   Reply Posted: 03 August 2010 at 7:39am\r\nThank you,  Mark \r\n fix_it\r\nNewbie\r\nJoined: 16 November 2012\r\nStatus: Offline\r\nPoints: 1\r\n Post Options    Thanks(0)    Quote   Reply Posted: 16 November 2012 at 2:01am\r\nMake it work already! It is broken from the beginning.\r\nSee this\r\nhttp://www.kernelmode.info/forum/viewtopic.php?p=16552#p16552\r\n\u0026\r\nhttp://blogs.comodo.com/pc-security/computer-protection/trojware-win32-trojanspy-volisk-a/\r\nSource: https://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html\r\nhttps://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html"
	],
	"report_names": [
		"appcertdlls_topic12546.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434604,
	"ts_updated_at": 1775791255,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1758114555b373db35b628c8adc9fe39692e0f46.pdf",
		"text": "https://archive.orkl.eu/1758114555b373db35b628c8adc9fe39692e0f46.txt",
		"img": "https://archive.orkl.eu/1758114555b373db35b628c8adc9fe39692e0f46.jpg"
	}
}