Analyzer Log
2025-06-22 01:43:46,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpf7a_02
2025-06-22 01:43:46,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\DOORFYVJcnaUMTotQtMBYKvYVaPZCJU
2025-06-22 01:43:46,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\cgVvvqisFhchvuQoOu
2025-06-22 01:43:46,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-06-22 01:43:46,015 [analyzer] INFO: Automatically selected analysis package "exe"
2025-06-22 01:43:46,375 [analyzer] DEBUG: Started auxiliary module Curtain
2025-06-22 01:43:46,375 [analyzer] DEBUG: Started auxiliary module DbgView
2025-06-22 01:43:46,796 [analyzer] DEBUG: Started auxiliary module Disguise
2025-06-22 01:43:47,015 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-06-22 01:43:47,015 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-06-22 01:43:47,015 [analyzer] DEBUG: Started auxiliary module Human
2025-06-22 01:43:47,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-06-22 01:43:47,015 [analyzer] DEBUG: Started auxiliary module Reboot
2025-06-22 01:43:47,078 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-06-22 01:43:47,078 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-06-22 01:43:47,078 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-06-22 01:43:47,078 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-06-22 01:43:47,203 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\76460c88b0cfa710_system restore.exe' with arguments '' and pid 3060
2025-06-22 01:43:47,405 [analyzer] DEBUG: Loaded monitor into process with pid 3060
2025-06-22 01:43:47,467 [analyzer] INFO: Added new file to list with pid 3060 and path C:\Users\Administrator\AppData\Local\Temp\backup.exe
2025-06-22 01:43:47,483 [analyzer] INFO: Added new file to list with pid 3060 and path C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
2025-06-22 01:43:47,546 [analyzer] INFO: Injected into process with pid 292 and name ''
2025-06-22 01:43:47,703 [analyzer] DEBUG: Loaded monitor into process with pid 292
2025-06-22 01:43:47,765 [analyzer] INFO: Added new file to list with pid 3060 and path C:\Users\Administrator\AppData\Local\Temp\9C7EA51D-B2B9-4ABB-A82F-1B32707A146E\backup.exe
2025-06-22 01:43:47,828 [analyzer] INFO: Added new file to list with pid 3060 and path C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\update.exe
2025-06-22 01:43:48,733 [analyzer] INFO: Added new file to list with pid 292 and path C:\update.exe
2025-06-22 01:47:06,203 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-06-22 01:47:07,125 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-06-22 01:47:07,125 [lib.api.process] INFO: Successfully terminated process with pid 3060.
2025-06-22 01:47:07,125 [lib.api.process] INFO: Successfully terminated process with pid 292.
2025-06-22 01:47:07,140 [analyzer] INFO: Analysis completed.
Cuckoo Log
2025-06-27 11:34:42,393 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:43,431 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:44,473 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:45,502 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:46,528 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:47,578 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:48,607 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:49,709 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:51,029 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:52,371 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:53,415 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:54,437 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:55,521 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:56,593 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:57,646 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:58,699 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:34:59,755 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:00,834 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:02,049 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:03,158 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:04,231 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:05,494 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:06,747 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:07,936 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:08,977 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:10,011 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:11,051 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:12,087 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:13,127 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:14,165 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:15,413 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:16,441 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:17,492 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:18,533 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:19,574 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:20,609 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:21,939 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:23,238 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:24,847 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:26,011 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:27,067 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:28,137 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:29,209 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:30,277 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:31,358 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:32,455 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:33,514 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:34,559 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:35,623 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:36,697 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:37,753 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:38,797 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:39,863 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:40,900 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:41,932 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:42,957 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:43,987 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:45,011 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:46,036 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:47,083 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:48,138 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:49,510 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:50,620 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:51,654 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:52,739 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:53,773 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:54,809 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:55,850 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:56,931 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:57,981 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:35:59,193 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:00,293 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:01,382 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:02,481 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:03,553 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:04,613 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:05,698 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:07,404 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:08,498 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:09,911 [cuckoo.core.scheduler] DEBUG: Task #6600704: no machine available yet
2025-06-27 11:36:11,034 [cuckoo.core.scheduler] INFO: Task #6600704: acquired machine win7x6427 (label=win7x6427)
2025-06-27 11:36:11,047 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.227 for task #6600704
2025-06-27 11:36:11,618 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 189913 (interface=vboxnet0, host=192.168.168.227)
2025-06-27 11:36:12,735 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6427
2025-06-27 11:36:13,586 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6427 to vmcloak
2025-06-27 11:39:47,291 [cuckoo.core.guest] INFO: Starting analysis #6600704 on guest (id=win7x6427, ip=192.168.168.227)
2025-06-27 11:39:48,296 [cuckoo.core.guest] DEBUG: win7x6427: not ready yet
2025-06-27 11:39:53,318 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6427, ip=192.168.168.227)
2025-06-27 11:39:53,385 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6427, ip=192.168.168.227, monitor=latest, size=6660546)
2025-06-27 11:39:54,670 [cuckoo.core.resultserver] DEBUG: Task #6600704: live log analysis.log initialized.
2025-06-27 11:39:55,631 [cuckoo.core.resultserver] DEBUG: Task #6600704 is sending a BSON stream
2025-06-27 11:39:56,005 [cuckoo.core.resultserver] DEBUG: Task #6600704 is sending a BSON stream
2025-06-27 11:39:56,608 [cuckoo.core.resultserver] DEBUG: Task #6600704 is sending a BSON stream
2025-06-27 11:39:56,857 [cuckoo.core.resultserver] DEBUG: Task #6600704: File upload for 'shots/0001.jpg'
2025-06-27 11:39:56,891 [cuckoo.core.resultserver] DEBUG: Task #6600704 uploaded file length: 133461
2025-06-27 11:40:10,080 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:40:26,895 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:40:42,079 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:40:57,224 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:41:13,043 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:41:28,490 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:41:45,074 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:42:01,229 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:42:16,390 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:42:31,596 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:42:47,010 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:43:02,586 [cuckoo.core.guest] DEBUG: win7x6427: analysis #6600704 still processing
2025-06-27 11:43:15,948 [cuckoo.core.resultserver] DEBUG: Task #6600704: File upload for 'curtain/1750549626.39.curtain.log'
2025-06-27 11:43:15,951 [cuckoo.core.resultserver] DEBUG: Task #6600704 uploaded file length: 36
2025-06-27 11:43:16,615 [cuckoo.core.resultserver] DEBUG: Task #6600704: File upload for 'sysmon/1750549627.05.sysmon.xml'
2025-06-27 11:43:16,684 [cuckoo.core.resultserver] DEBUG: Task #6600704 uploaded file length: 9005910
2025-06-27 11:43:16,725 [cuckoo.core.resultserver] DEBUG: Task #6600704: File upload for 'files/9ac3f373fcd3dc65_backup.exe'
2025-06-27 11:43:16,728 [cuckoo.core.resultserver] DEBUG: Task #6600704: File upload for 'files/a07583ccee601785_update.exe'
2025-06-27 11:43:16,730 [cuckoo.core.resultserver] DEBUG: Task #6600704 uploaded file length: 94618
2025-06-27 11:43:16,731 [cuckoo.core.resultserver] DEBUG: Task #6600704 had connection reset for <Context for LOG>
2025-06-27 11:43:16,733 [cuckoo.core.resultserver] DEBUG: Task #6600704 uploaded file length: 94620
2025-06-27 11:43:17,805 [cuckoo.core.guest] INFO: win7x6427: analysis completed successfully
2025-06-27 11:43:17,819 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-06-27 11:43:17,844 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-06-27 11:43:19,403 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6427 to path /srv/cuckoo/cwd/storage/analyses/6600704/memory.dmp
2025-06-27 11:43:19,409 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6427
2025-06-27 11:45:40,476 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.227 for task #6600704
2025-06-27 11:45:41,073 [cuckoo.core.scheduler] DEBUG: Released database task #6600704
2025-06-27 11:45:41,114 [cuckoo.core.scheduler] INFO: Task #6600704: analysis procedure completed