Artifacts

AxCrypt Artifacts

Posted by:  /  Tags:

Author Name
Matt Nelson

Artifact or Program Version
AxCrypt 1.7.2976.0

Artifact Description
From the AxCrypt website: (http://www.axantum.com/axcrypt/)

AxCrypt is the leading open source file encryption software for Windows. It integrates seamlessly with Windows to compress, encrypt, decrypt, store, send and work with individual files.

Features:

Password Protect any number of files using strong encryption.

Right-click integration with Windows Explorer makes AxCrypt the easiest way to encrypt individual files in Windows.

Double-click integration makes it as easy to open, edit and save protected files as it is to work with unprotected files.

Many additional features, but no configuration required. Just install it and use it.

AxCrypt encrypts files that are safely and easily sent to other users via e-mail or any other means. Self-decrypting files are also supported, removing the need to install AxCrypt to decrypt.

Registry Keys
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\axcrypt.File

HKLM\SOFTWARE\Classes\CLSID\{C3DFC144-30F8-4138-81F9-578DBEB9324A}

HKLM\SOFTWARE\Classes\CLSID\{C3DFC144-30F8-4138-81F9-578DBEB9324A}\InprocServer32

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\axcrypt.File

HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\87A9C44140AFC0B46B4FF660E3C886D5

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\87A9C44140AFC0B46B4FF660E3C886D5

KLM\SOFTWARE\Classes\.axx

HKLM\SOFTWARE\Classes\axcrypt.File

HKLM\SOFTWARE\Classes\axcrypt.File\CLSID

HKLM\SOFTWARE\Classes\axcrypt.File\DefaultIcon

HKLM\SOFTWARE\Classes\axcrypt.File\shell

HKLM\SOFTWARE\Classes\axcrypt.File\shell\open

HKLM\SOFTWARE\Classes\axcrypt.File\shell\open\command

HKLM\SOFTWARE\Classes\axcrypt.File\shellex

HKLM\SOFTWARE\Classes\axcrypt.File\shellex\PropertySheetHandlers

HKLM\SOFTWARE\Classes\axcrypt.File\shellex\PropertySheetHandlers\{C3DFC144-30F8-4138-81F9-578DBEB9324A}

HKLM\SOFTWARE\Axantum

HKLM\SOFTWARE\Axantum\AxCrypt

HKU\[USERSID]\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Axantum AxCrypt

HKU\[USERSID]\Software\Axantum

HKU\[USERSID]\Software\Axantum\AxCrypt

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{38350E9E-D50E-454A-BAFC-58BBDDBE08C4}\DisplayName: “AxCrypt 1.7.2976.0″

HKLM\SOFTWARE\Axantum\AxCrypt\FileExtension: “.axx”

HKLM\SOFTWARE\Axantum\AxCrypt\ProductName: “AxCrypt”

HKLM\SOFTWARE\Axantum\AxCrypt\CLSID: “{C3DFC144-30F8-4138-81F9-578DBEB9324A}”

HKLM\SOFTWARE\Axantum\AxCrypt\ShowActivationMenu: 0×00000000

HKLM\SOFTWARE\Axantum\AxCrypt\KeyWrapIterations: 0x00003A98

HKLM\SOFTWARE\Axantum\AxCrypt\AllowPrograms: 0×00000000

HKLM\SOFTWARE\Axantum\AxCrypt\DisableSaveEncryptionKey: 0×00000000

HKLM\SOFTWARE\Axantum\AxCrypt\DisableSaveDecryptionKey: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\installed: 0×00000001

HKU\[USERSID]\Software\Axantum\AxCrypt\CompressThreshold: 0×00000014

HKU\[USERSID]\Software\Axantum\AxCrypt\ServerMode: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\ServerErrorShellCmd: “”

HKU\[USERSID]\Software\Axantum\AxCrypt\EventLogLevel: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\NoShowUnsafeWipeWarn: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\SaveEncKey: 0×00000001

HKU\[USERSID]\Software\Axantum\AxCrypt\SaveDecKey: 0×00000001

HKU\[USERSID]\Software\Axantum\AxCrypt\NoDecryptMenu: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\DisableRenameMenu: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\TryBrokenFile: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\AllowAnyExtension: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\FastModeDefault: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\KeepTimeStamp: 0×00000000

HKU\[USERSID]\Software\Axantum\AxCrypt\AllowPrograms: 0×00000000

File Locations
C:\Program Files\Axantum\AxCrypt

Research Links

http://www.axantum.com/axcrypt/

Forensic Programs of Use
Regshot – http://regshot.sourceforge.net/

MiTeC HEX Editor – http://www.mitec.cz/hex.html

wxHexEditor – http://www.wxhexeditor.org/

Other Information
First 21 bytes for AxCrypt encrypted file(s):

C0 B9 07 2E 4F 93 F1 46 A0 15 79 2C A1 D9 E8 21 15 00 00 00 02

Raw:

0000000 C0 B9 07 2E 4F 93 F1 46 A0 15 ….O..F..

0000010 79 2C A1 D9 E8 21 15 00 00 00 y,…!….

0000020 02 .

Leave a Reply

Your Name: (required)

Your Email: (will not be published) (required)

Your Website:

Your Message:

submit comment