9.0
极危
58 个模型检测该样本为恶意！
重新分析
更多

24676397320c85928b2fc53501109d63f3fb34a6aba00446c7ed5fbd272fda8b

ad93ca38c07a1882cb07bcab30dbb267.exe

分析耗时

102s

最近分析

文件大小

1.3MB
静态报毒 动态报毒 AGENERIC AI SCORE=84 AIDETECTVM ATOSEV CHEAP COBALT COBALTSTRIKE COBRA CONFIDENCE CRYPTERX FENBID GENCIRC GENERICKD HIGH CONFIDENCE HZS9HKZPWYL KRYPTIK MALWARE2 MALWARE@#123JPUAXZKFY4 R06EC0CI920 R217659 RHZ@AS4MUGHI ROZENA SCORE SUSGEN SUSPICIOUS PE SWRORT UNSAFE ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Trojan-Cobalt!AD93CA38C07A 20201022 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:CrypterX-gen [Trj] 20201022 18.4.3895.0
Alibaba VirTool:Win32/Atosev.bd42cc97 20190527 0.3.0.5
Tencent Malware.Win32.Gencirc.10b8b042 20201022 1.0.0.1
Kingsoft 20201022 2013.8.14.323
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620924030.651751
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620924028.260751
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620924027.432751
__exception__
stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 4585708
registers.edi: 0
registers.eax: 0
registers.ebp: 4585724
registers.edx: 16846848
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 89 08 50 45 43 6f 6d 70 61 63 74 32 00 c0 c9 8e
exception.symbol: flashplayerpp_install_cn+0x1016
exception.instruction: mov dword ptr [eax], ecx
exception.module: flashplayerpp_install_cn.exe
exception.exception_code: 0xc0000005
exception.offset: 4118
exception.address: 0x1011016
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Performs some HTTP requests (8 个事件)
request GET http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s32844983697403?AQB=1&ndh=1&t=13%2F4%2F2021%2017%3A0%3A41%204%20-480&ce=UTF-8&ns=adobecorp&pageName=acdc_fp_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5CAdministrator.Oskar-PC%5CDocuments%5Cflashplayerpp_install_cn.exe%2F160&ch=acdc_flashplayer&events=event96&products=%3Bflashplayer_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=zh_cn&c5=zh_cn%3Aacdc_fp_adm_launched&v18=new&v22=thursday%20-%203%3A00am&v73=acdc_flashplayer&s=800x600&c=32&j=1.5&v=Y&k=N&bw=654&bh=401&ct=lan&hp=N&AQE=1
request GET http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s32844983697403?AQB=1&pccr=true&vidn=304E733882AF29CF-40001100E1C04FE1&ndh=1&t=13%2F4%2F2021%2017%3A0%3A41%204%20-480&ce=UTF-8&ns=adobecorp&pageName=acdc_fp_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5CAdministrator.Oskar-PC%5CDocuments%5Cflashplayerpp_install_cn.exe%2F160&ch=acdc_flashplayer&events=event96&products=%3Bflashplayer_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=zh_cn&c5=zh_cn%3Aacdc_fp_adm_launched&v18=new&v22=thursday%20-%203%3A00am&v73=acdc_flashplayer&s=800x600&c=32&j=1.5&v=Y&k=N&bw=654&bh=401&ct=lan&hp=N&AQE=1
request GET https://www.flash.cn/cdm/en/application.xml
request GET https://api.flash.cn/cdm/getoffer-new?guid=0
request GET https://api.flash.cn/cdm/ueip
request GET https://www.flash.cn/cdm/cn/flashplayerpp.xml
request GET https://www.flash.cn/cdm/en/helperservice.xml
request GET https://dlmping2.adobe.com/dlm/dlm.gif?adm_name=Adobe%20Flash%20Player&adm_vers=3.0.0.459s&currentFilename=flashplayerpp_install_cn.exe&os=win&os_loc=zh_CN&os_ver=6.1.1&site=live&type=install
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620924027.432751
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00220000
success 0 0
1620923669.763645
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004050000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\Documents\flashplayerpp_install_cn.exe
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Public\Desktop\Google Chrome.lnk
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\Documents\flashplayerpp_install_cn.exe
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1620897722.743307
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x009b0000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620897723.415307
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620924041.651751
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 268435456
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 47.240.45.183
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620897725.993307
RegSetValueExA
key_handle: 0x00000424
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620897725.993307
RegSetValueExA
key_handle: 0x00000424
value: ЯvlÖG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620897725.993307
RegSetValueExA
key_handle: 0x00000424
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620897725.993307
RegSetValueExW
key_handle: 0x00000424
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620897726.008307
RegSetValueExA
key_handle: 0x00000468
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620897726.008307
RegSetValueExA
key_handle: 0x00000468
value: ЯvlÖG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620897726.008307
RegSetValueExA
key_handle: 0x00000468
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620897726.024307
RegSetValueExW
key_handle: 0x00000324
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620924042.541751
RegSetValueExA
key_handle: 0x0000072c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620924042.541751
RegSetValueExA
key_handle: 0x0000072c
value: ÐeÿsÖG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620924042.541751
RegSetValueExA
key_handle: 0x0000072c
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620924042.541751
RegSetValueExW
key_handle: 0x0000072c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620924042.541751
RegSetValueExA
key_handle: 0x0000070c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620924042.541751
RegSetValueExA
key_handle: 0x0000070c
value: ÐeÿsÖG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620924042.541751
RegSetValueExA
key_handle: 0x0000070c
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Network activity contains more than one unique useragent (2 个事件)
process ad93ca38c07a1882cb07bcab30dbb267.exe useragent
process flashplayerpp_install_cn.exe useragent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.CobaltStrike.BH
FireEye Generic.mg.ad93ca38c07a1882
CAT-QuickHeal TrojanAPT.Cobalt.A7
McAfee Trojan-Cobalt!AD93CA38C07A
Malwarebytes Trojan.Downloader
VIPRE Trojan.Win32.Generic.pak!cobra
Sangfor Malware
K7AntiVirus Trojan ( 005622831 )
BitDefender Trojan.CobaltStrike.BH
K7GW Trojan ( 005622831 )
Cybereason malicious.8c07a1
TrendMicro TROJ_GEN.R06EC0CI920
BitDefenderTheta Gen:NN.ZexaF.34570.rHZ@aS4muGhi
Symantec Backdoor.Cobalt
APEX Malicious
Avast Win32:CrypterX-gen [Trj]
ClamAV Win.Trojan.CobaltStrike-7899872-1
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba VirTool:Win32/Atosev.bd42cc97
NANO-Antivirus Trojan.Win32.Swrort.fenbid
Tencent Malware.Win32.Gencirc.10b8b042
Ad-Aware Trojan.CobaltStrike.BH
Sophos ATK/Cobalt-A
Comodo Malware@#123jpuaxzkfy4
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.Swrort.41
Zillya Trojan.GenericKD.Win32.125331
Invincea ATK/Cobalt-A
McAfee-GW-Edition BehavesLike.Win32.Adware.tc
Emsisoft Trojan.CobaltStrike.BH (B)
SentinelOne DFI - Suspicious PE
Jiangmin Trojan.Generic.cheap
Webroot W32.Downloader.Gen
Avira TR/Dropper.Gen
Antiy-AVL Trojan/Win32.AGeneric
Microsoft Trojan:Win32/Cobaltstrike.MK!MTB
Arcabit Trojan.CobaltStrike.BH
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Trojan.CobaltStrike.BH
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Kryptik.R217659
VBA32 Trojan.Swrort
ALYac Trojan.Agent.Rozena
MAX malware (ai score=84)
Cylance Unsafe
Panda Trj/CI.A
ESET-NOD32 a variant of Win32/Rozena.AMZ
TrendMicro-HouseCall TROJ_GEN.R06EC0CI920
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 47.240.45.183:60002
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-04-05 09:01:24

Imports

Library KERNEL32.dll:
• 0x406174 CloseHandle
• 0x406178 ConnectNamedPipe
• 0x40617c CreateFileA
• 0x406180 CreateNamedPipeA
• 0x406184 CreateThread
• 0x406190 FreeLibrary
• 0x406194 GetCurrentProcess
• 0x406198 GetCurrentProcessId
• 0x40619c GetCurrentThreadId
• 0x4061a0 GetLastError
• 0x4061a4 GetModuleFileNameA
• 0x4061a8 GetModuleHandleA
• 0x4061ac GetProcAddress
• 0x4061b0 GetStartupInfoA
• 0x4061b8 GetTickCount
• 0x4061c4 LoadLibraryA
• 0x4061c8 LoadLibraryW
• 0x4061d0 ReadFile
• 0x4061d8 Sleep
• 0x4061dc TerminateProcess
• 0x4061e0 TlsGetValue
• 0x4061e8 VirtualAlloc
• 0x4061ec VirtualProtect
• 0x4061f0 VirtualQuery
• 0x4061f4 WriteFile
Library msvcrt.dll:
• 0x4061fc __dllonexit
• 0x406200 __getmainargs
• 0x406204 __initenv
• 0x406208 __lconv_init
• 0x40620c __set_app_type
• 0x406210 __setusermatherr
• 0x406214 _acmdln
• 0x406218 _amsg_exit
• 0x40621c _cexit
• 0x406220 _fmode
• 0x406224 _initterm
• 0x406228 _iob
• 0x40622c _lock
• 0x406230 _onexit
• 0x406234 _snprintf
• 0x406238 _unlock
• 0x40623c _winmajor
• 0x406240 abort
• 0x406244 calloc
• 0x406248 exit
• 0x40624c fclose
• 0x406250 fopen
• 0x406254 fprintf
• 0x406258 fread
• 0x40625c free
• 0x406260 fseek
• 0x406264 ftell
• 0x406268 fwrite
• 0x40626c malloc
• 0x406270 memcpy
• 0x406274 signal
• 0x406278 sprintf
• 0x40627c strlen
• 0x406280 strncmp
• 0x406284 vfprintf
Library SHELL32.DLL:
• 0x40628c SHGetFolderPathA
• 0x406290 ShellExecuteA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49184 23.55.248.146 dlmping2.adobe.com 443
192.168.56.101 49185 44.233.255.254 stats.adobe.com 80
192.168.56.101 49182 58.216.107.221 api.flash.cn 443
192.168.56.101 49183 58.216.107.234 api.flash.cn 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s32844983697403?AQB=1&ndh=1&t=13%2F4%2F2021%2017%3A0%3A41%204%20-480&ce=UTF-8&ns=adobecorp&pageName=acdc_fp_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5CAdministrator.Oskar-PC%5CDocuments%5Cflashplayerpp_install_cn.exe%2F160&ch=acdc_flashplayer&events=event96&products=%3Bflashplayer_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=zh_cn&c5=zh_cn%3Aacdc_fp_adm_launched&v18=new&v22=thursday%20-%203%3A00am&v73=acdc_flashplayer&s=800x600&c=32&j=1.5&v=Y&k=N&bw=654&bh=401&ct=lan&hp=N&AQE=1 
GET /b/ss/adbacdcprod/1/H.25.4/s32844983697403?AQB=1&ndh=1&t=13%2F4%2F2021%2017%3A0%3A41%204%20-480&ce=UTF-8&ns=adobecorp&pageName=acdc_fp_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5CAdministrator.Oskar-PC%5CDocuments%5Cflashplayerpp_install_cn.exe%2F160&ch=acdc_flashplayer&events=event96&products=%3Bflashplayer_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=zh_cn&c5=zh_cn%3Aacdc_fp_adm_launched&v18=new&v22=thursday%20-%203%3A00am&v73=acdc_flashplayer&s=800x600&c=32&j=1.5&v=Y&k=N&bw=654&bh=401&ct=lan&hp=N&AQE=1 HTTP/1.1
Accept: */*
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: stats.adobe.com
Connection: Keep-Alive
http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s32844983697403?AQB=1&pccr=true&vidn=304E733882AF29CF-40001100E1C04FE1&ndh=1&t=13%2F4%2F2021%2017%3A0%3A41%204%20-480&ce=UTF-8&ns=adobecorp&pageName=acdc_fp_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5CAdministrator.Oskar-PC%5CDocuments%5Cflashplayerpp_install_cn.exe%2F160&ch=acdc_flashplayer&events=event96&products=%3Bflashplayer_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=zh_cn&c5=zh_cn%3Aacdc_fp_adm_launched&v18=new&v22=thursday%20-%203%3A00am&v73=acdc_flashplayer&s=800x600&c=32&j=1.5&v=Y&k=N&bw=654&bh=401&ct=lan&hp=N&AQE=1 
GET /b/ss/adbacdcprod/1/H.25.4/s32844983697403?AQB=1&pccr=true&vidn=304E733882AF29CF-40001100E1C04FE1&ndh=1&t=13%2F4%2F2021%2017%3A0%3A41%204%20-480&ce=UTF-8&ns=adobecorp&pageName=acdc_fp_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5CAdministrator.Oskar-PC%5CDocuments%5Cflashplayerpp_install_cn.exe%2F160&ch=acdc_flashplayer&events=event96&products=%3Bflashplayer_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=zh_cn&c5=zh_cn%3Aacdc_fp_adm_launched&v18=new&v22=thursday%20-%203%3A00am&v73=acdc_flashplayer&s=800x600&c=32&j=1.5&v=Y&k=N&bw=654&bh=401&ct=lan&hp=N&AQE=1 HTTP/1.1
Accept: */*
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: stats.adobe.com
Connection: Keep-Alive
Cookie: s_vi=[CS]v1|304E733882AF29CF-40001100E1C04FE1[CE]

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.