API tools faq
paste
paladin316

Vidar_68b8185a934b390d2f7275ee1ea14339-07-23_08_30.txt

paladin316
Jul 23rd, 2019
2,388
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.52 KB | None | 0 0
raw download clone embed print report
  1. * MalFamily: ""
  2.  
  3. * MalScore: 6.0
  4.  
  5. * File Name: "Vidar_68b8185a934b390d2f7275ee1ea14339.pdf"
  6. * File Size: 18785
  7. * File Type: "PDF document, version 1.4"
  8. * SHA256: "63e94c93c871bfed5192109604ace54e4090cda3d0be37de202df5c31c252177"
  9. * MD5: "68b8185a934b390d2f7275ee1ea14339"
  10. * SHA1: "e1de2982f5bea48704c74d0034bac1f0fe44c999"
  11. * SHA512: "f8e9196c6c4e06dc036955d6579e7d562b37a557f14adfdedce53e68bbdbc9206492902f76677acfb66006266d187bbf349d498d250ce9a74923a9362e013b0c"
  12. * CRC32: "D8CC34FB"
  13. * SSDEEP: "384:Snk6PzQy/903uK3sBEbALlndnmufHYWDB+GmAYh0RrL3LyW:Sk4k3uKcBtlndZYg+nt0VbmW"
  14.  
  15. * Process Execution:
  16. "AcroRd32.exe",
  17. "Eula.exe",
  18. "AdobeARM.exe",
  19. "Reader_sl.exe",
  20. "svchost.exe"
  21.  
  22.  
  23. * Executed Commands:
  24. "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" --type=renderer \"C:\\Users\\user\\AppData\\Local\\Temp\\Ursnif_68b8185a934b390d2f7275ee1ea14339.pdf\"",
  25. "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" --backgroundcolor=16514043",
  26. "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Eula.exe\" Adobe Acrobat Reader DC;459238;1033",
  27. "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" /PRODUCT:Reader /VERSION:19.0 /MODE:3",
  28. "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Reader_sl.exe "
  29.  
  30.  
  31. * Signatures Detected:
  32.  
  33. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  34. "Details":
  35.  
  36. "IP": "23.59.190.113:80"
  37.  
  38.  
  39. "IP": "96.17.4.162:443"
  40.  
  41.  
  42. "IP": "72.21.91.29:80"
  43.  
  44.  
  45.  
  46.  
  47. "Description": "Expresses interest in specific running processes",
  48. "Details":
  49.  
  50. "process": "RdrCEF.exe"
  51.  
  52.  
  53.  
  54.  
  55. "Description": "Reads data out of its own binary image",
  56. "Details":
  57.  
  58. "self_read": "process: Eula.exe, pid: 2400, offset: 0x00000000, length: 0x00000040"
  59.  
  60.  
  61. "self_read": "process: Eula.exe, pid: 2400, offset: 0x00000100, length: 0x00000018"
  62.  
  63.  
  64. "self_read": "process: Eula.exe, pid: 2400, offset: 0x000001f8, length: 0x000000a0"
  65.  
  66.  
  67. "self_read": "process: Eula.exe, pid: 2400, offset: 0x00012600, length: 0x00000010"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "Performs some HTTP requests",
  73. "Details":
  74.  
  75. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  76.  
  77.  
  78.  
  79.  
  80. "Description": "The PDF has one page. Many malicious PDFs only have one page.",
  81. "Details":
  82.  
  83.  
  84. "Description": "The PDF file contains suspicious characteristics",
  85. "Details":
  86.  
  87. "single_page": "PDF contains one page. Many malicious PDFs only have one page."
  88.  
  89.  
  90.  
  91.  
  92. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  93. "Details":
  94.  
  95. "http_request": "acrord32.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbsauqybmq2awn1rh6doh%2fsbygfv7gqua95qnvbrtltm8kpigxvdl7i90vuceah9o%2btuynxiieolckvpvje%3d http/1.1\r\ncache-control: max-age = 142986\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: tue, 28 may 2019 07:40:28 gmt\r\nif"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "Attempts to modify proxy settings",
  101. "Details":
  102.  
  103.  
  104.  
  105. * Started Service:
  106.  
  107. * Mutexes:
  108. "100184D2-BDC3-477a-B8D3-65548B67914C_2532",
  109. "Global\\100184D2-BDC3-477a-B8D3-65548B67914C_3064",
  110. "com.adobe.acrobat.rna.RdrCefBrowserLock.DC",
  111. "Local\\WininetStartupMutex",
  112. "Local\\ZonesCounterMutex",
  113. "Local\\ZoneAttributeCacheCounterMutex",
  114. "Local\\ZonesCacheCounterMutex",
  115. "Local\\ZonesLockedCacheCounterMutex",
  116. "CicLoadWinStaWinSta0",
  117. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  118. "Local\\_!MSFTHISTORY!_",
  119. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  120. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  121. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  122. "Local\\!IETld!Mutex",
  123. "_!SHMSFTHISTORY!_",
  124. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!mshist012019072320190724!"
  125.  
  126.  
  127. * Modified Files:
  128. "C:\\Users\\user\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc",
  129. "C:\\Users\\user\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc",
  130. "C:\\Users\\user\\AppData\\Local\\Adobe\\Color\\ACECache11.lst",
  131. "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages",
  132. "C:\\Users\\user\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin",
  133. "\\??\\pipe\\com.adobe.reader.rna.user.DC.0",
  134. "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Reader\\DesktopNotification\\NotificationsDB\\notificationsDB",
  135. "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Reader\\DesktopNotification\\NotificationsDB\\notificationsDB-journal",
  136. "C:\\Users\\user\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents",
  137. "C:\\Users\\user\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents-journal",
  138. "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ConnectorIcons\\icon-190723103031Z-2097.bmp",
  139. "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal",
  140. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6",
  141. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6",
  142. "C:\\Users\\user\\AppData\\Local\\Temp\\acrord32_sbx\\A9Rndd89i_cmq12w_1fw.tmp",
  143. "C:\\Users\\user\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl",
  144. "C:\\Users\\user\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl",
  145. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  147. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  148. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019072320190724\\index.dat",
  149. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  150. "\\??\\pipe\\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E001599590523thsnYaVieBoda",
  151. "C:\\Users\\user\\AppData\\Local\\Temp\\ArmUI.ini"
  152.  
  153.  
  154. * Deleted Files:
  155. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019052620190527\\index.dat",
  156. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019052620190527\\"
  157.  
  158.  
  159. * Modified Registry Keys:
  160. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Acrobat\\DC\\DiskCabs",
  161. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC",
  162. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC",
  163. "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\AcrobatDC",
  164. "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\Reader DC",
  165. "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\Reader 19_Acrobat19_Reader_19.10.20069",
  166. "HKEY_LOCAL_MACHINE\\System\\Acrobatbrokerserverdispatchercpp789",
  167. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Installer",
  168. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Installer\\Migrated",
  169. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language",
  170. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language\\UseMUI",
  171. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language\\next",
  172. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language\\current",
  173. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Originals",
  174. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\ExitSection",
  175. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC\\Acrobat.com",
  176. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC\\Acrobat.com.v2",
  177. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVConnector",
  178. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVConnector\\cv1",
  179. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral",
  180. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cTaskPanes",
  181. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cTaskPanes\\cBasicCommentPane",
  182. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\FTEDialog",
  183. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\FlashDebug",
  184. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\OnBoardingSection",
  185. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\OnBoardingSection\\chomeView",
  186. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\SDI",
  187. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Selection",
  188. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Window",
  189. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Window\\cAVUIPopupList",
  190. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1",
  191. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\aFS",
  192. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\tDIText",
  193. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\tFileName",
  194. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\sFileAncestors",
  195. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\sDI",
  196. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\sDate",
  197. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVEntitlement",
  198. "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION",
  199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION\\AcroRd32.exe",
  200. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC\\CredentialsV3",
  201. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Workflows",
  202. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Workflows\\cServices",
  203. "HKEY_CURRENT_USER\\SOFTWARE\\Adobe\\Acrobat Reader\\DC\\Privileged",
  204. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Privileged\\bOldRecentFilesMigrated",
  205. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVConnector\\cIconCache",
  206. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\UsageMeasurement",
  207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  210. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\IPM",
  211. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab",
  212. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cDocumentCenter",
  213. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cDocumentCenter\\cSettings",
  214. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cEmailDistribution",
  215. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cEmailDistribution\\cSettings",
  216. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cInternalServer",
  217. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cInternalServer\\cSettings",
  218. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Collab\\cInitiationWizardFirstLaunch",
  219. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security",
  220. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cHandlers",
  221. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI",
  222. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI",
  223. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs",
  224. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c290FA7E61053E8763C6055E6333A99EFB83ECACB",
  225. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c290FA7E61053E8763C6055E6333A99EFB83ECACB\\cAdobe_OCSPRevChecker",
  226. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c290FA7E61053E8763C6055E6333A99EFB83ECACB\\cAdobe_OCSPRevChecker\\cAuthorizedResponder",
  227. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c290FA7E61053E8763C6055E6333A99EFB83ECACB\\cAdobe_OCSPRevChecker\\cAuthorizedResponder\\c0",
  228. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000",
  229. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_ChainBuilder",
  230. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs",
  231. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c0",
  232. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c0\\cValue",
  233. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c1",
  234. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c1\\cValue",
  235. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker",
  236. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cAuthorizedResponder",
  237. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cAuthorizedResponder\\c0",
  238. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cSendNonce",
  239. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cSendNonce\\c0",
  240. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cSignCertOID",
  241. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cSignCertOID\\c0",
  242. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cSignRequest",
  243. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cSignRequest\\c0",
  244. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cURLToConsult",
  245. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E310000\\cAdobe_OCSPRevChecker\\cURLToConsult\\c0",
  246. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000",
  247. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_ChainBuilder",
  248. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs",
  249. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c0",
  250. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c0\\cValue",
  251. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c1",
  252. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_ChainBuilder\\cAcceptablePolicyOIDs\\c1\\cValue",
  253. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker",
  254. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cAuthorizedResponder",
  255. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cAuthorizedResponder\\c0",
  256. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cSendNonce",
  257. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cSendNonce\\c0",
  258. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cSignCertOID",
  259. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cSignCertOID\\c0",
  260. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cSignRequest",
  261. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cSignRequest\\c0",
  262. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cURLToConsult",
  263. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E322E3834302E3131343032312E312E312E310000\\cAdobe_OCSPRevChecker\\cURLToConsult\\c0",
  264. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000",
  265. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_CRLRevChecker",
  266. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_CRLRevChecker\\cRequireAKI",
  267. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_CRLRevChecker\\cRequireAKI\\c0",
  268. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_ChainBuilder",
  269. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_ChainBuilder\\cAllowCAToIssueAC",
  270. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_ChainBuilder\\cAllowCAToIssueAC\\c0",
  271. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_ChainBuilder\\cCheckCABasicConstraints",
  272. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_ChainBuilder\\cCheckCABasicConstraints\\c0",
  273. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_OCSPRevChecker",
  274. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_OCSPRevChecker\\cAllowOCSPNoCheck",
  275. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_OCSPRevChecker\\cAllowOCSPNoCheck\\c0",
  276. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_OCSPRevChecker\\cRequireOCSPCertHash",
  277. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_OCSPRevChecker\\cRequireOCSPCertHash\\c0",
  278. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_Validation",
  279. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_Validation\\cValidityModel",
  280. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cASPKI\\cASPKI\\cCustomCertPrefs\\c312E332E33362E382E312E310000\\cAdobe_Validation\\cValidityModel\\c0",
  281. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Security\\cPPKHandler",
  282. "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\ADDRESSBOOK",
  283. "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\ADDRESSBOOK\\Certificates",
  284. "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\ADDRESSBOOK\\CRLs",
  285. "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\ADDRESSBOOK\\CTLs",
  286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072320190724",
  289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072320190724\\CachePath",
  290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072320190724\\CachePrefix",
  291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072320190724\\CacheLimit",
  292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072320190724\\CacheOptions",
  293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019072320190724\\CacheRepair",
  294. "HKEY_LOCAL_MACHINE\\Software\\Adobe\\Acrobat Reader\\DC\\AdobeViewer",
  295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Adobe\\Acrobat Reader\\DC\\AdobeViewer\\EULA",
  296. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AdobeViewer",
  297. "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AdobeViewer\\EULA",
  298. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe ARM\\1.0\\ARM\\iSpeedLauncherLogonTime"
  299.  
  300.  
  301. * Deleted Registry Keys:
  302. "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\Reader DC\\OptIn",
  303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
  305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  306. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  308. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFavoritesInitialSelection",
  310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFeedsInitialSelection",
  311. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe ARM\\1.0\\ARM\\iNotify"
  312.  
  313.  
  314. * DNS Communications:
  315.  
  316. * Domains:
  317.  
  318. * Network Communication - ICMP:
  319.  
  320. * Network Communication - HTTP:
  321.  
  322. "count": 1,
  323. "body": "",
  324. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  325. "user-agent": "Microsoft-CryptoAPI/6.1",
  326. "method": "GET",
  327. "host": "ocsp.digicert.com",
  328. "version": "1.1",
  329. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  330. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  331. "port": 80
  332.  
  333.  
  334. "count": 1,
  335. "body": "",
  336. "uri": "http://acroipm2.adobe.com/19/rdr/ENU/win/nooem/none/consumer/message.zip",
  337. "user-agent": "IPM",
  338. "method": "GET",
  339. "host": "acroipm2.adobe.com",
  340. "version": "1.1",
  341. "path": "/19/rdr/ENU/win/nooem/none/consumer/message.zip",
  342. "data": "GET /19/rdr/ENU/win/nooem/none/consumer/message.zip HTTP/1.1\r\nAccept: */*\r\nIf-Modified-Since: Mon, 01 Jan 1970 00:00:00 GMT\r\nUser-Agent: IPM\r\nHost: acroipm2.adobe.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  343. "port": 80
  344.  
  345.  
  346.  
  347. * Network Communication - SMTP:
  348.  
  349. * Network Communication - Hosts:
  350.  
  351. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!