Analyzer Log
2025-07-25 13:05:50,030 [analyzer] DEBUG: Starting analyzer from: C:\tmp4w2pkt
2025-07-25 13:05:50,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\CzpOxYThChogdjyrPbxWpHIcMoMHB
2025-07-25 13:05:50,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\hiqlKEPAxxYETlOidEDRRmn
2025-07-25 13:05:50,342 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-25 13:05:50,342 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-25 13:05:50,796 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-25 13:05:51,015 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-07-25 13:05:51,015 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-25 13:05:51,015 [analyzer] DEBUG: Started auxiliary module Human
2025-07-25 13:05:51,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-25 13:05:51,015 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-25 13:05:51,078 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-25 13:05:51,078 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-25 13:05:51,078 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-25 13:05:51,078 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-25 13:05:51,217 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\be6e41cfb6a92529b6b530ad2266630d9c1ed087136c04ff1ff65f709452ea05.exe' with arguments '' and pid 2680
2025-07-25 13:05:51,358 [analyzer] DEBUG: Loaded monitor into process with pid 2680
2025-07-25 13:05:51,437 [analyzer] INFO: Added new file to list with pid 2680 and path C:\$Recycle.Bin\S-1-5-21-3740676788-1466591295-3783685072-500\desktop.ini.tmp
2025-07-25 13:05:52,421 [analyzer] INFO: Added new file to list with pid 2680 and path C:\agent.pyw.tmp
2025-07-25 13:05:53,171 [analyzer] INFO: Added new file to list with pid 2680 and path C:\msdia80.dll.tmp
2025-07-25 13:05:54,390 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\Office32WW.msi.tmp
2025-07-25 13:05:56,187 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\Office32WW.xml.tmp
2025-07-25 13:05:57,046 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\ose.exe.tmp
2025-07-25 13:05:57,875 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\osetup.dll.tmp
2025-07-25 13:06:02,562 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\PidGenX.dll.tmp
2025-07-25 13:06:04,140 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.tmp
2025-07-25 13:06:05,217 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\setup.exe.tmp
2025-07-25 14:59:33,413 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\Setup.xml.tmp
2025-07-25 14:59:34,148 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\StandardWW.msi.tmp
2025-07-25 14:59:44,694 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\StandardWW.xml.tmp
2025-07-25 14:59:45,631 [analyzer] INFO: Added new file to list with pid 2680 and path C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.tmp
2025-07-25 14:59:46,913 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-25 14:59:47,490 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-25 14:59:47,490 [lib.api.process] INFO: Successfully terminated process with pid 2680.
2025-07-25 14:59:47,490 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\setup.exe.tmp' does not exist, skip.
2025-07-25 14:59:47,553 [analyzer] WARNING: File at path u'c:\\$recycle.bin\\s-1-5-21-3740676788-1466591295-3783685072-500\\desktop.ini.tmp' does not exist, skip.
2025-07-25 14:59:47,553 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.tmp' does not exist, skip.
2025-07-25 14:59:47,553 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\standardww.msi.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\agent.pyw.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msdia80.dll.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\pidgenx.dll.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\osetup.dll.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\ose.exe.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\office32ww.msi.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\setup.xml.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\office32ww.xml.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\standardww.xml.tmp' does not exist, skip.
2025-07-25 14:59:47,569 [analyzer] INFO: Analysis completed.
Cuckoo Log
2025-07-25 15:56:02,118 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:03,165 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:04,246 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:05,338 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:06,413 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:07,495 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:08,525 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:09,559 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:10,590 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:11,685 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:12,711 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:13,746 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:14,787 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:15,845 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:16,911 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:18,095 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:19,175 [cuckoo.core.scheduler] DEBUG: Task #6759056: no machine available yet
2025-07-25 15:56:20,261 [cuckoo.core.scheduler] INFO: Task #6759056: acquired machine win7x6423 (label=win7x6423)
2025-07-25 15:56:20,263 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.223 for task #6759056
2025-07-25 15:56:20,629 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 658005 (interface=vboxnet0, host=192.168.168.223)
2025-07-25 15:56:22,454 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6423
2025-07-25 15:56:23,680 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6423 to vmcloak
2025-07-25 15:59:09,210 [cuckoo.core.guest] INFO: Starting analysis #6759056 on guest (id=win7x6423, ip=192.168.168.223)
2025-07-25 15:59:10,218 [cuckoo.core.guest] DEBUG: win7x6423: not ready yet
2025-07-25 15:59:15,243 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6423, ip=192.168.168.223)
2025-07-25 15:59:15,331 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6423, ip=192.168.168.223, monitor=latest, size=6660546)
2025-07-25 15:59:16,686 [cuckoo.core.resultserver] DEBUG: Task #6759056: live log analysis.log initialized.
2025-07-25 15:59:17,644 [cuckoo.core.resultserver] DEBUG: Task #6759056 is sending a BSON stream
2025-07-25 15:59:17,986 [cuckoo.core.resultserver] DEBUG: Task #6759056 is sending a BSON stream
2025-07-25 15:59:18,931 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'shots/0001.jpg'
2025-07-25 15:59:18,968 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 133459
2025-07-25 15:59:19,102 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/e1b9ce9b57957b1a_desktop.ini'
2025-07-25 15:59:19,105 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 129
2025-07-25 15:59:19,852 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/7674a841e0162121_agent.pyw'
2025-07-25 15:59:19,855 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 12712
2025-07-25 15:59:21,064 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/c883b5d2e16d22b0_msdia80.dll'
2025-07-25 15:59:21,073 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 904704
2025-07-25 15:59:22,806 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/d2126415b32dadd8_Office32WW.msi'
2025-07-25 15:59:22,857 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 1992192
2025-07-25 15:59:23,732 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/f2332c24397c5064_Office32WW.xml'
2025-07-25 15:59:23,735 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 4274
2025-07-25 15:59:24,551 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/52ad72c05facc1e0_ose.exe'
2025-07-25 15:59:24,555 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 174440
2025-07-25 15:59:29,005 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/dfff75a35f25b8b0_osetup.dll'
2025-07-25 15:59:29,069 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 7378792
2025-07-25 15:59:30,776 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/48b8b32b9ffe3734_PidGenX.dll'
2025-07-25 15:59:30,788 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 1463568
2025-07-25 15:59:31,583 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6759056 still processing
2025-07-25 15:59:31,877 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/edfb49cd35fe352a_pkeyconfig-office.xrm-ms'
2025-07-25 15:59:31,884 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 715834
2025-07-25 15:59:33,297 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/916946889ad9dd85_setup.exe'
2025-07-25 15:59:33,390 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 1377656
2025-07-25 15:59:34,135 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/4009f775a780f7af_Setup.xml'
2025-07-25 15:59:34,138 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 28397
2025-07-25 15:59:44,058 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/c1a8a46a852aab17_StandardWW.msi'
2025-07-25 15:59:44,201 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 19756032
2025-07-25 15:59:45,627 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/25dbaa25ce964d41_StandardWW.xml'
2025-07-25 15:59:45,630 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 14617
2025-07-25 15:59:46,840 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6759056 still processing
2025-07-25 15:59:47,157 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'curtain/1753448387.15.curtain.log'
2025-07-25 15:59:47,160 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 36
2025-07-25 15:59:47,457 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'sysmon/1753448387.46.sysmon.xml'
2025-07-25 15:59:47,494 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 2023698
2025-07-25 15:59:47,527 [cuckoo.core.resultserver] DEBUG: Task #6759056: File upload for 'files/86a3d0fa76eaa8a8_excellr.cab.tmp'
2025-07-25 15:59:47,560 [cuckoo.core.resultserver] DEBUG: Task #6759056 uploaded file length: 3575808
2025-07-25 15:59:47,842 [cuckoo.core.resultserver] DEBUG: Task #6759056 had connection reset for <Context for LOG>
2025-07-25 15:59:49,852 [cuckoo.core.guest] INFO: win7x6423: analysis completed successfully
2025-07-25 15:59:49,864 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-25 15:59:49,890 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-25 15:59:51,211 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6423 to path /srv/cuckoo/cwd/storage/analyses/6759056/memory.dmp
2025-07-25 15:59:51,213 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6423
2025-07-25 16:02:43,297 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.223 for task #6759056
2025-07-25 16:02:43,690 [cuckoo.core.scheduler] DEBUG: Released database task #6759056
2025-07-25 16:02:43,733 [cuckoo.core.scheduler] INFO: Task #6759056: analysis procedure completed
