search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.54k stars 1.7k forks source link

Windows XP VM won't work (time out) #1550

Open wirehack7 opened 7 years ago

wirehack7 commented 7 years ago

I'm using Cuckoo 2.0.2 in Ubuntu 16.04 LTS. Environment is VMWare ESX 6.5

I have two VM's: Windows 7 and Windows XP

Both are set up identical (despite the client IP). agent.pyw is running via pythonw.exe (version 2.7). Firewall and Updates are disabled. The VM has access to the network and WWW. I can reach the agent of the WinXP VM via curl on port 8000.

esx.conf:

[WindowsXP]
label = analysis_winxp
snapshot = clean
ip = 172.16.0.3
platform = windows
interface = ens160
osprofile = WinXPSP3x86

I tested with osprofile and without. Whenever I upload a file for analysis the WinXP VM fails:

2017-05-14 18:09:15,172 [cuckoo.core.scheduler] INFO: Starting analysis of FILE "zerber.exe" (task #2, options "procmemdump=yes,route=tor")
2017-05-14 18:09:15,202 [cuckoo.core.scheduler] INFO: Task #2: acquired machine WindowsXP (label=analysis_winxp)
2017-05-14 18:09:15,210 [cuckoo.auxiliary.mitm] INFO: Started mitm interception with PID 893 (ip=172.16.0.1, port=50000).
2017-05-14 18:09:15,223 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 894 (interface=ens160, host=172.16.0.3, pcap=/home/cuckoo/.cuckoo/storage/analyses/2/dump.pcap)
2017-05-14 18:09:16,179 [cuckoo.core.guest] INFO: Starting analysis on guest (id=WindowsXP, ip=172.16.0.3)
2017-05-14 18:09:16,334 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.7 (id=WindowsXP, ip=172.16.0.3)
2017-05-14 18:12:17,729 [cuckoo.core.scheduler] ERROR: Error from the Cuckoo Guest: The analysis hit the critical timeout, terminating.
2017-05-14 18:12:18,641 [cuckoo.processing.behavior] WARNING: Analysis results folder does not contain any behavior log files.
    May 14 18:12:19 main.c:599 main(): THREAD 0x7feebc7be780

I tested it with several files, all the same error. No file will be dropped into the VM and no files are created on desktop (user behaviour). Cuckoo just starts the VM to the given snapshot and then it idles, resulting into time out.

I am running out of thoughts here what is the problem there.

wirehack7 commented 7 years ago

Ran Cuckoo with debugging messages (long log):

cuckoo@cuckoo:~$ cuckoo -d

    sSSs   .S       S.     sSSs   .S    S.     sSSs_sSSs      sSSs_sSSs
   d%%SP  .SS       SS.   d%%SP  .SS    SS.   d%%SP~YS%%b    d%%SP~YS%%b
  d%S'    S%S       S%S  d%S'    S%S    S&S  d%S'     `S%b  d%S'     `S%b
  S%S     S%S       S%S  S%S     S%S    d*S  S%S       S%S  S%S       S%S
  S&S     S&S       S&S  S&S     S&S   .S*S  S&S       S&S  S&S       S&S
  S&S     S&S       S&S  S&S     S&S_sdSSS   S&S       S&S  S&S       S&S
  S&S     S&S       S&S  S&S     S&S~YSSY%b  S&S       S&S  S&S       S&S
  S&S     S&S       S&S  S&S     S&S    `S%  S&S       S&S  S&S       S&S
  S*b     S*b       d*S  S*b     S*S     S%  S*b       d*S  S*b       d*S
  S*S.    S*S.     .S*S  S*S.    S*S     S&  S*S.     .S*S  S*S.     .S*S
   SSSbs   SSSbs_sdSSS    SSSbs  S*S     S&   SSSbs_sdSSS    SSSbs_sdSSS
    YSSP    YSSP~YSSY      YSSP  S*S     SS    YSSP~YSSY      YSSP~YSSY
                                 SP
                                 Y

 Cuckoo Sandbox 2.0.3a4
 www.cuckoosandbox.org
 Copyright (c) 2010-2017

 Checking for updates...
 You're good to go!
2017-05-15 18:19:36,282 [cuckoo.core.startup] DEBUG: Imported modules...
2017-05-15 18:19:36,288 [cuckoo.core.startup] DEBUG: Imported "auxiliary" modules:
2017-05-15 18:19:36,288 [cuckoo.core.startup] DEBUG:     |-- MITM
2017-05-15 18:19:36,289 [cuckoo.core.startup] DEBUG:     |-- Reboot
2017-05-15 18:19:36,289 [cuckoo.core.startup] DEBUG:     |-- Services
2017-05-15 18:19:36,289 [cuckoo.core.startup] DEBUG:     `-- Sniffer
2017-05-15 18:19:36,289 [cuckoo.core.startup] DEBUG: Imported "machinery" modules:
2017-05-15 18:19:36,289 [cuckoo.core.startup] DEBUG:     |-- vSphere
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- KVM
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- ESX
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- XenServer
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- VirtualBox
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- Avd
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- QEMU
2017-05-15 18:19:36,290 [cuckoo.core.startup] DEBUG:     |-- VMware
2017-05-15 18:19:36,291 [cuckoo.core.startup] DEBUG:     `-- Physical
2017-05-15 18:19:36,291 [cuckoo.core.startup] DEBUG: Imported "processing" modules:
2017-05-15 18:19:36,291 [cuckoo.core.startup] DEBUG:     |-- AnalysisInfo
2017-05-15 18:19:36,291 [cuckoo.core.startup] DEBUG:     |-- ApkInfo
2017-05-15 18:19:36,291 [cuckoo.core.startup] DEBUG:     |-- Baseline
2017-05-15 18:19:36,291 [cuckoo.core.startup] DEBUG:     |-- BehaviorAnalysis
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- Debug
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- Droidmon
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- Dropped
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- DroppedBuffer
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- GooglePlay
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- Irma
2017-05-15 18:19:36,292 [cuckoo.core.startup] DEBUG:     |-- Memory
2017-05-15 18:19:36,293 [cuckoo.core.startup] DEBUG:     |-- MetaInfo
2017-05-15 18:19:36,293 [cuckoo.core.startup] DEBUG:     |-- MISP
2017-05-15 18:19:36,293 [cuckoo.core.startup] DEBUG:     |-- NetworkAnalysis
2017-05-15 18:19:36,293 [cuckoo.core.startup] DEBUG:     |-- ProcessMemory
2017-05-15 18:19:36,293 [cuckoo.core.startup] DEBUG:     |-- Procmon
2017-05-15 18:19:36,293 [cuckoo.core.startup] DEBUG:     |-- Screenshots
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     |-- Snort
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     |-- Static
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     |-- Strings
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     |-- Suricata
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     |-- TargetInfo
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     |-- TLSMasterSecrets
2017-05-15 18:19:36,294 [cuckoo.core.startup] DEBUG:     `-- VirusTotal
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG: Imported "signatures" modules:
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG:     |-- AndroidAbortBroadcast
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG:     |-- AndroidAccountInfo
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG:     |-- AndroidAppInfo
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG:     |-- AndroidAudio
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG:     |-- AndroidCamera
2017-05-15 18:19:36,295 [cuckoo.core.startup] DEBUG:     |-- AndroidDangerousPermissions
2017-05-15 18:19:36,296 [cuckoo.core.startup] DEBUG:     |-- AndroidDeletedApp
2017-05-15 18:19:36,296 [cuckoo.core.startup] DEBUG:     |-- AndroidDynamicCode
2017-05-15 18:19:36,296 [cuckoo.core.startup] DEBUG:     |-- AndroidEmbeddedApk
2017-05-15 18:19:36,296 [cuckoo.core.startup] DEBUG:     |-- AndroidGooglePlayDiff
2017-05-15 18:19:36,296 [cuckoo.core.startup] DEBUG:     |-- AndroidInstalledApps
2017-05-15 18:19:36,296 [cuckoo.core.startup] DEBUG:     |-- AndroidNativeCode
2017-05-15 18:19:36,297 [cuckoo.core.startup] DEBUG:     |-- AndroidPhoneNumber
2017-05-15 18:19:36,297 [cuckoo.core.startup] DEBUG:     |-- AndroidPrivateInfoQuery
2017-05-15 18:19:36,297 [cuckoo.core.startup] DEBUG:     |-- AndroidReflectionCode
2017-05-15 18:19:36,297 [cuckoo.core.startup] DEBUG:     |-- AndroidRegisteredReceiver
2017-05-15 18:19:36,297 [cuckoo.core.startup] DEBUG:     |-- AndroidShellCommands
2017-05-15 18:19:36,297 [cuckoo.core.startup] DEBUG:     |-- AndroidSMS
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- AndroidStopProcess
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- ApplicationUsesLocation
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- KnownVirustotal
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- AntiAnalysisJavascript
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- DumpedBuffer
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- DumpedBuffer2
2017-05-15 18:19:36,298 [cuckoo.core.startup] DEBUG:     |-- EncryptionKeys
2017-05-15 18:19:36,299 [cuckoo.core.startup] DEBUG:     |-- EvalJS
2017-05-15 18:19:36,299 [cuckoo.core.startup] DEBUG:     |-- Exploit_zteF460F660
2017-05-15 18:19:36,299 [cuckoo.core.startup] DEBUG:     |-- HtmlFlash
2017-05-15 18:19:36,299 [cuckoo.core.startup] DEBUG:     |-- JsIframe
2017-05-15 18:19:36,299 [cuckoo.core.startup] DEBUG:     |-- SuspiciousJavascript
2017-05-15 18:19:36,299 [cuckoo.core.startup] DEBUG:     |-- DarwinCodeInjection
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- TaskForPid
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- DeadHost
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- NetworkBIND
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- NetworkDynDNS
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- NetworkHTTP
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- NetworkICMP
2017-05-15 18:19:36,300 [cuckoo.core.startup] DEBUG:     |-- NetworkIRC
2017-05-15 18:19:36,301 [cuckoo.core.startup] DEBUG:     |-- NetworkSMTP
2017-05-15 18:19:36,301 [cuckoo.core.startup] DEBUG:     |-- SnortAlert
2017-05-15 18:19:36,301 [cuckoo.core.startup] DEBUG:     |-- SuricataAlert
2017-05-15 18:19:36,301 [cuckoo.core.startup] DEBUG:     |-- TorGateway
2017-05-15 18:19:36,301 [cuckoo.core.startup] DEBUG:     |-- WscriptDownloader
2017-05-15 18:19:36,301 [cuckoo.core.startup] DEBUG:     |-- ADS
2017-05-15 18:19:36,302 [cuckoo.core.startup] DEBUG:     |-- Adzok
2017-05-15 18:19:36,302 [cuckoo.core.startup] DEBUG:     |-- AlinaFile
2017-05-15 18:19:36,302 [cuckoo.core.startup] DEBUG:     |-- AlineURL
2017-05-15 18:19:36,302 [cuckoo.core.startup] DEBUG:     |-- AllocatesRWX
2017-05-15 18:19:36,302 [cuckoo.core.startup] DEBUG:     |-- Andromeda
2017-05-15 18:19:36,302 [cuckoo.core.startup] DEBUG:     |-- AntiAnalysisDetectFile
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiAVDetectFile
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiAVDetectReg
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiAVSRP
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiDBGDevices
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiDBGWindows
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxFile
2017-05-15 18:19:36,303 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxForegroundWindow
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxIdleTime
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxSleep
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiVMBios
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiVMComputernameQuery
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiVMCPU
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiVMDiskSize
2017-05-15 18:19:36,304 [cuckoo.core.startup] DEBUG:     |-- AntiVMIDE
2017-05-15 18:19:36,305 [cuckoo.core.startup] DEBUG:     |-- AntiVMSCSI
2017-05-15 18:19:36,305 [cuckoo.core.startup] DEBUG:     |-- AntiVMServices
2017-05-15 18:19:36,305 [cuckoo.core.startup] DEBUG:     |-- AntiVMSharedDevice
2017-05-15 18:19:36,305 [cuckoo.core.startup] DEBUG:     |-- APT_Carbunak
2017-05-15 18:19:36,305 [cuckoo.core.startup] DEBUG:     |-- APT_CloudAtlas
2017-05-15 18:19:36,305 [cuckoo.core.startup] DEBUG:     |-- apt_sandworm_ip
2017-05-15 18:19:36,306 [cuckoo.core.startup] DEBUG:     |-- apt_sandworm_url
2017-05-15 18:19:36,306 [cuckoo.core.startup] DEBUG:     |-- ArdamaxMutexes
2017-05-15 18:19:36,306 [cuckoo.core.startup] DEBUG:     |-- AthenaHttp
2017-05-15 18:19:36,306 [cuckoo.core.startup] DEBUG:     |-- AthenaURL
2017-05-15 18:19:36,306 [cuckoo.core.startup] DEBUG:     |-- Autorun
2017-05-15 18:19:36,306 [cuckoo.core.startup] DEBUG:     |-- AvastDetectLibs
2017-05-15 18:19:36,307 [cuckoo.core.startup] DEBUG:     |-- AVDetectionChinaKey
2017-05-15 18:19:36,307 [cuckoo.core.startup] DEBUG:     |-- BadCerts
2017-05-15 18:19:36,307 [cuckoo.core.startup] DEBUG:     |-- Bagle
2017-05-15 18:19:36,307 [cuckoo.core.startup] DEBUG:     |-- Bandook
2017-05-15 18:19:36,307 [cuckoo.core.startup] DEBUG:     |-- banker_bancos
2017-05-15 18:19:36,307 [cuckoo.core.startup] DEBUG:     |-- BankingMutexes
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- Banload
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- Beastdoor
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- BeebusMutexes
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- BegseabugTDMutexes
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- BetabotURL
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- Bifrose
2017-05-15 18:19:36,308 [cuckoo.core.startup] DEBUG:     |-- BitcoinOpenCL
2017-05-15 18:19:36,309 [cuckoo.core.startup] DEBUG:     |-- BitcoinWallet
2017-05-15 18:19:36,309 [cuckoo.core.startup] DEBUG:     |-- BitdefenderDetectLibs
2017-05-15 18:19:36,309 [cuckoo.core.startup] DEBUG:     |-- BlackEnergyMutexes
2017-05-15 18:19:36,309 [cuckoo.core.startup] DEBUG:     |-- Blackhole
2017-05-15 18:19:36,309 [cuckoo.core.startup] DEBUG:     |-- BlackholeURL
2017-05-15 18:19:36,309 [cuckoo.core.startup] DEBUG:     |-- Blackice
2017-05-15 18:19:36,310 [cuckoo.core.startup] DEBUG:     |-- BlackposURL
2017-05-15 18:19:36,310 [cuckoo.core.startup] DEBUG:     |-- BlackRevMutexes
2017-05-15 18:19:36,310 [cuckoo.core.startup] DEBUG:     |-- Blackshades
2017-05-15 18:19:36,310 [cuckoo.core.startup] DEBUG:     |-- BladabindiMutexes
2017-05-15 18:19:36,310 [cuckoo.core.startup] DEBUG:     |-- BochsDetectKeys
2017-05-15 18:19:36,310 [cuckoo.core.startup] DEBUG:     |-- Bottilda
2017-05-15 18:19:36,311 [cuckoo.core.startup] DEBUG:     |-- BozokKey
2017-05-15 18:19:36,311 [cuckoo.core.startup] DEBUG:     |-- browser_startpage
2017-05-15 18:19:36,311 [cuckoo.core.startup] DEBUG:     |-- BrowserSecurity
2017-05-15 18:19:36,311 [cuckoo.core.startup] DEBUG:     |-- BrowserStealer
2017-05-15 18:19:36,311 [cuckoo.core.startup] DEBUG:     |-- Btcbotnet
2017-05-15 18:19:36,311 [cuckoo.core.startup] DEBUG:     |-- Bublik
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- BuildLangID
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- BuzusMutexes
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- BypassFirewall
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- c24URL
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- CarberpMutexes
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- Ceatrg
2017-05-15 18:19:36,312 [cuckoo.core.startup] DEBUG:     |-- ChanitorMutexes
2017-05-15 18:19:36,313 [cuckoo.core.startup] DEBUG:     |-- CheckIP
2017-05-15 18:19:36,313 [cuckoo.core.startup] DEBUG:     |-- cloud_mediafire
2017-05-15 18:19:36,313 [cuckoo.core.startup] DEBUG:     |-- cloud_wetransfer
2017-05-15 18:19:36,313 [cuckoo.core.startup] DEBUG:     |-- CloudFlare
2017-05-15 18:19:36,313 [cuckoo.core.startup] DEBUG:     |-- CloudGoogle
2017-05-15 18:19:36,313 [cuckoo.core.startup] DEBUG:     |-- CoinminerMutexes
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- ComRAT
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- Crash
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- CreatesAutorunInf
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- CreatesDocument
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- CreatesExe
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- CreatesService
2017-05-15 18:19:36,314 [cuckoo.core.startup] DEBUG:     |-- CreatesSuspiciousProcess
2017-05-15 18:19:36,315 [cuckoo.core.startup] DEBUG:     |-- Cridex
2017-05-15 18:19:36,315 [cuckoo.core.startup] DEBUG:     |-- Cryptolocker
2017-05-15 18:19:36,315 [cuckoo.core.startup] DEBUG:     |-- CuckooDetectFiles
2017-05-15 18:19:36,315 [cuckoo.core.startup] DEBUG:     |-- Cybergate
2017-05-15 18:19:36,315 [cuckoo.core.startup] DEBUG:     |-- Dapato
2017-05-15 18:19:36,315 [cuckoo.core.startup] DEBUG:     |-- Darkcloud
2017-05-15 18:19:36,316 [cuckoo.core.startup] DEBUG:     |-- DarkddosMutexes
2017-05-15 18:19:36,316 [cuckoo.core.startup] DEBUG:     |-- Darkshell
2017-05-15 18:19:36,316 [cuckoo.core.startup] DEBUG:     |-- Ddos556
2017-05-15 18:19:36,316 [cuckoo.core.startup] DEBUG:     |-- Decay
2017-05-15 18:19:36,316 [cuckoo.core.startup] DEBUG:     |-- DecebalMutexes
2017-05-15 18:19:36,316 [cuckoo.core.startup] DEBUG:     |-- DeletesSelf
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- DelfTrojan
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- DEPHeapBypass
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- DEPStackBypass
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- DerusbiMutexes
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- Dexter
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- Dibik
2017-05-15 18:19:36,317 [cuckoo.core.startup] DEBUG:     |-- DirtJumper
2017-05-15 18:19:36,318 [cuckoo.core.startup] DEBUG:     |-- DisableCmd
2017-05-15 18:19:36,318 [cuckoo.core.startup] DEBUG:     |-- DisableRegedit
2017-05-15 18:19:36,318 [cuckoo.core.startup] DEBUG:     |-- DisablesAppLaunch
2017-05-15 18:19:36,318 [cuckoo.core.startup] DEBUG:     |-- DisablesBrowserWarn
2017-05-15 18:19:36,318 [cuckoo.core.startup] DEBUG:     |-- DisablesSecurity
2017-05-15 18:19:36,318 [cuckoo.core.startup] DEBUG:     |-- DisablesSPDY
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- DisablesSystemRestore
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- DisablesWER
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- DisablesWindowsUpdate
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- DisableTaskMgr
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- DiskInformation
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- DisplaysHTA
2017-05-15 18:19:36,319 [cuckoo.core.startup] DEBUG:     |-- Dns_Freehosting_Domain
2017-05-15 18:19:36,320 [cuckoo.core.startup] DEBUG:     |-- DNS_TLD_BY
2017-05-15 18:19:36,320 [cuckoo.core.startup] DEBUG:     |-- DNS_TLD_CC
2017-05-15 18:19:36,320 [cuckoo.core.startup] DEBUG:     |-- DNS_TLD_ONION
2017-05-15 18:19:36,320 [cuckoo.core.startup] DEBUG:     |-- DNS_TLD_PW
2017-05-15 18:19:36,320 [cuckoo.core.startup] DEBUG:     |-- DNS_TLD_RU
2017-05-15 18:19:36,320 [cuckoo.core.startup] DEBUG:     |-- DNS_TLD_SU
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- dnsserver_dynamic
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- DoFoil
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- DownloaderCabby
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- Drive
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- Drive2
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- DriverLoad
2017-05-15 18:19:36,321 [cuckoo.core.startup] DEBUG:     |-- DropBox
2017-05-15 18:19:36,322 [cuckoo.core.startup] DEBUG:     |-- Dropper
2017-05-15 18:19:36,322 [cuckoo.core.startup] DEBUG:     |-- Dyreza
2017-05-15 18:19:36,322 [cuckoo.core.startup] DEBUG:     |-- EclipseMutexes
2017-05-15 18:19:36,322 [cuckoo.core.startup] DEBUG:     |-- Emotet
2017-05-15 18:19:36,322 [cuckoo.core.startup] DEBUG:     |-- Evilbot
2017-05-15 18:19:36,322 [cuckoo.core.startup] DEBUG:     |-- exp_3322_dom
2017-05-15 18:19:36,323 [cuckoo.core.startup] DEBUG:     |-- Expiro
2017-05-15 18:19:36,323 [cuckoo.core.startup] DEBUG:     |-- ExploitHeapspray
2017-05-15 18:19:36,323 [cuckoo.core.startup] DEBUG:     |-- ExploitKitMutexes
2017-05-15 18:19:36,323 [cuckoo.core.startup] DEBUG:     |-- FakeAVMutexes
2017-05-15 18:19:36,323 [cuckoo.core.startup] DEBUG:     |-- FakeAVMutexes
2017-05-15 18:19:36,323 [cuckoo.core.startup] DEBUG:     |-- FakeRean
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- FarFli
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- FesberMutexes
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- Fingerprint
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- Flame
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- Flystudio
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- FortinetDetectFiles
2017-05-15 18:19:36,324 [cuckoo.core.startup] DEBUG:     |-- FTPStealer
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- Fynloski
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- Gaelicum
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- Ghostbot
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- HasAuthenticode
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- HasOfficeEps
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- HasPdb
2017-05-15 18:19:36,325 [cuckoo.core.startup] DEBUG:     |-- HasWMI
2017-05-15 18:19:36,326 [cuckoo.core.startup] DEBUG:     |-- Hesperbot
2017-05-15 18:19:36,326 [cuckoo.core.startup] DEBUG:     |-- Hikit
2017-05-15 18:19:36,326 [cuckoo.core.startup] DEBUG:     |-- HookMouse
2017-05-15 18:19:36,326 [cuckoo.core.startup] DEBUG:     |-- Hupigon
2017-05-15 18:19:36,326 [cuckoo.core.startup] DEBUG:     |-- HyperVDetectKeys
2017-05-15 18:19:36,326 [cuckoo.core.startup] DEBUG:     |-- IcePoint
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- IEMartian
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- im_btb
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- im_qq
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- IMStealer
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- InceptionAPT
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- Infinity
2017-05-15 18:19:36,327 [cuckoo.core.startup] DEBUG:     |-- InjectionRunPE
2017-05-15 18:19:36,328 [cuckoo.core.startup] DEBUG:     |-- InjectionThread
2017-05-15 18:19:36,328 [cuckoo.core.startup] DEBUG:     |-- InstalledApps
2017-05-15 18:19:36,328 [cuckoo.core.startup] DEBUG:     |-- InstallsAppInit
2017-05-15 18:19:36,328 [cuckoo.core.startup] DEBUG:     |-- InstallsBHO
2017-05-15 18:19:36,328 [cuckoo.core.startup] DEBUG:     |-- InstallsWinpcap
2017-05-15 18:19:36,328 [cuckoo.core.startup] DEBUG:     |-- IPKillerMutexes
2017-05-15 18:19:36,329 [cuckoo.core.startup] DEBUG:     |-- Ircbrute
2017-05-15 18:19:36,329 [cuckoo.core.startup] DEBUG:     |-- ISRstealerURL
2017-05-15 18:19:36,329 [cuckoo.core.startup] DEBUG:     |-- iStealerURL
2017-05-15 18:19:36,329 [cuckoo.core.startup] DEBUG:     |-- JackPOSFile
2017-05-15 18:19:36,329 [cuckoo.core.startup] DEBUG:     |-- JackposURL
2017-05-15 18:19:36,329 [cuckoo.core.startup] DEBUG:     |-- JeefoMutexes
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- Jewdo
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- JintorMutexes
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- JorikTrojan
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- Karagany
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- Karakum
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- Katusha
2017-05-15 18:19:36,330 [cuckoo.core.startup] DEBUG:     |-- KelihosBot
2017-05-15 18:19:36,331 [cuckoo.core.startup] DEBUG:     |-- Keylogger
2017-05-15 18:19:36,331 [cuckoo.core.startup] DEBUG:     |-- Kilim
2017-05-15 18:19:36,331 [cuckoo.core.startup] DEBUG:     |-- Killdisk
2017-05-15 18:19:36,331 [cuckoo.core.startup] DEBUG:     |-- KnownVirustotal
2017-05-15 18:19:36,331 [cuckoo.core.startup] DEBUG:     |-- Koobface
2017-05-15 18:19:36,331 [cuckoo.core.startup] DEBUG:     |-- Koutodoor
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- KovterBot
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- KrepperMutexes
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- KuluozMutexes
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- Likseput
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- LocatesBrowser
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- LocatesSniffer
2017-05-15 18:19:36,332 [cuckoo.core.startup] DEBUG:     |-- Lockscreen
2017-05-15 18:19:36,333 [cuckoo.core.startup] DEBUG:     |-- LolBot
2017-05-15 18:19:36,333 [cuckoo.core.startup] DEBUG:     |-- Luder
2017-05-15 18:19:36,333 [cuckoo.core.startup] DEBUG:     |-- Madness
2017-05-15 18:19:36,333 [cuckoo.core.startup] DEBUG:     |-- Madness
2017-05-15 18:19:36,333 [cuckoo.core.startup] DEBUG:     |-- MadnessURL
2017-05-15 18:19:36,333 [cuckoo.core.startup] DEBUG:     |-- MaganiaMutexes
2017-05-15 18:19:36,334 [cuckoo.core.startup] DEBUG:     |-- MailStealer
2017-05-15 18:19:36,334 [cuckoo.core.startup] DEBUG:     |-- MaliciousDocumentURLs
2017-05-15 18:19:36,334 [cuckoo.core.startup] DEBUG:     |-- MegaUpload
2017-05-15 18:19:36,334 [cuckoo.core.startup] DEBUG:     |-- MemoryAvailable
2017-05-15 18:19:36,334 [cuckoo.core.startup] DEBUG:     |-- Minerbot
2017-05-15 18:19:36,334 [cuckoo.core.startup] DEBUG:     |-- miningpool
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- MircFile
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- ModifiesDesktopWallpaper
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- ModifiesFiles
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- ModifiesUACNotify
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- MyBot
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- Nakbot
2017-05-15 18:19:36,335 [cuckoo.core.startup] DEBUG:     |-- Napolar
2017-05-15 18:19:36,336 [cuckoo.core.startup] DEBUG:     |-- Nebuler
2017-05-15 18:19:36,336 [cuckoo.core.startup] DEBUG:     |-- Netobserve
2017-05-15 18:19:36,336 [cuckoo.core.startup] DEBUG:     |-- Netshadow
2017-05-15 18:19:36,336 [cuckoo.core.startup] DEBUG:     |-- Netwire
2017-05-15 18:19:36,336 [cuckoo.core.startup] DEBUG:     |-- NetworkAdapters
2017-05-15 18:19:36,336 [cuckoo.core.startup] DEBUG:     |-- NetworkDocumentFile
2017-05-15 18:19:36,337 [cuckoo.core.startup] DEBUG:     |-- NetworkEXE
2017-05-15 18:19:36,337 [cuckoo.core.startup] DEBUG:     |-- Nitol
2017-05-15 18:19:36,337 [cuckoo.core.startup] DEBUG:     |-- NjRat
2017-05-15 18:19:36,337 [cuckoo.core.startup] DEBUG:     |-- ObfusMutexes
2017-05-15 18:19:36,337 [cuckoo.core.startup] DEBUG:     |-- OfficeCreateObject
2017-05-15 18:19:36,337 [cuckoo.core.startup] DEBUG:     |-- OfficeEpsStrings
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- OfficeHttpRequest
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- OfficePackager
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- OfficeRecentFiles
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- OfficeVulnerableGuid
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- OfficeVulnModules
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- Oldrea
2017-05-15 18:19:36,338 [cuckoo.core.startup] DEBUG:     |-- PackerEntropy
2017-05-15 18:19:36,339 [cuckoo.core.startup] DEBUG:     |-- Palevo
2017-05-15 18:19:36,339 [cuckoo.core.startup] DEBUG:     |-- ParallelsDetectKeys
2017-05-15 18:19:36,339 [cuckoo.core.startup] DEBUG:     |-- Pasta
2017-05-15 18:19:36,339 [cuckoo.core.startup] DEBUG:     |-- PcClientMutexes
2017-05-15 18:19:36,339 [cuckoo.core.startup] DEBUG:     |-- PEFeatures
2017-05-15 18:19:36,339 [cuckoo.core.startup] DEBUG:     |-- PerfLogger
2017-05-15 18:19:36,340 [cuckoo.core.startup] DEBUG:     |-- PersistenceBootexecute
2017-05-15 18:19:36,340 [cuckoo.core.startup] DEBUG:     |-- Phorpiex
2017-05-15 18:19:36,340 [cuckoo.core.startup] DEBUG:     |-- Pidief
2017-05-15 18:19:36,340 [cuckoo.core.startup] DEBUG:     |-- Plugx
2017-05-15 18:19:36,340 [cuckoo.core.startup] DEBUG:     |-- Poebot
2017-05-15 18:19:36,340 [cuckoo.core.startup] DEBUG:     |-- PoisonIvy
2017-05-15 18:19:36,341 [cuckoo.core.startup] DEBUG:     |-- Polymorphic
2017-05-15 18:19:36,341 [cuckoo.core.startup] DEBUG:     |-- Ponfoy
2017-05-15 18:19:36,341 [cuckoo.core.startup] DEBUG:     |-- PonyURL
2017-05-15 18:19:36,341 [cuckoo.core.startup] DEBUG:     |-- PosCardStealerURL
2017-05-15 18:19:36,341 [cuckoo.core.startup] DEBUG:     |-- Prinimalka
2017-05-15 18:19:36,341 [cuckoo.core.startup] DEBUG:     |-- ProcessInterest
2017-05-15 18:19:36,342 [cuckoo.core.startup] DEBUG:     |-- ProcessNeeded
2017-05-15 18:19:36,342 [cuckoo.core.startup] DEBUG:     |-- ProcMemDumpURLs
2017-05-15 18:19:36,342 [cuckoo.core.startup] DEBUG:     |-- Psyokym
2017-05-15 18:19:36,342 [cuckoo.core.startup] DEBUG:     |-- PuceMutexes
2017-05-15 18:19:36,342 [cuckoo.core.startup] DEBUG:     |-- PutterpandaMutexes
2017-05-15 18:19:36,342 [cuckoo.core.startup] DEBUG:     |-- Putty
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- PWDumpFile
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- Pykse
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- Qakbot
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- Ragebot
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- RaisesException
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- Ramnit
2017-05-15 18:19:36,343 [cuckoo.core.startup] DEBUG:     |-- ransomware_viruscoder
2017-05-15 18:19:36,344 [cuckoo.core.startup] DEBUG:     |-- RansomwareBcdedit
2017-05-15 18:19:36,344 [cuckoo.core.startup] DEBUG:     |-- RansomwareExtensions
2017-05-15 18:19:36,344 [cuckoo.core.startup] DEBUG:     |-- RansomwareFiles
2017-05-15 18:19:36,344 [cuckoo.core.startup] DEBUG:     |-- RansomwareShadowcopy
2017-05-15 18:19:36,344 [cuckoo.core.startup] DEBUG:     |-- RapidShare
2017-05-15 18:19:36,344 [cuckoo.core.startup] DEBUG:     |-- rat_fexel_ip
2017-05-15 18:19:36,345 [cuckoo.core.startup] DEBUG:     |-- rat_naid_ip
2017-05-15 18:19:36,345 [cuckoo.core.startup] DEBUG:     |-- RatSiggen
2017-05-15 18:19:36,345 [cuckoo.core.startup] DEBUG:     |-- RBot
2017-05-15 18:19:36,345 [cuckoo.core.startup] DEBUG:     |-- RdpMutexes
2017-05-15 18:19:36,345 [cuckoo.core.startup] DEBUG:     |-- Renocide
2017-05-15 18:19:36,345 [cuckoo.core.startup] DEBUG:     |-- RenosTrojan
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- Rovnix
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- Runbu
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- RunouceMutexes
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- Ruskill
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- Sadbot
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- SandboxieDetect
2017-05-15 18:19:36,346 [cuckoo.core.startup] DEBUG:     |-- SandboxJoeAnubisDetectFiles
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- SDBot
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- SelfDeleteBat
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- Senna
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- Shadowbot
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- SharingRGhost
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- SharpStealerURL
2017-05-15 18:19:36,347 [cuckoo.core.startup] DEBUG:     |-- ShellcodeWriteProcessMemory
2017-05-15 18:19:36,348 [cuckoo.core.startup] DEBUG:     |-- Shiz
2017-05-15 18:19:36,348 [cuckoo.core.startup] DEBUG:     |-- ShutdownSystem
2017-05-15 18:19:36,348 [cuckoo.core.startup] DEBUG:     |-- Shylock
2017-05-15 18:19:36,348 [cuckoo.core.startup] DEBUG:     |-- SipStun
2017-05-15 18:19:36,348 [cuckoo.core.startup] DEBUG:     |-- Smtp_GMail
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- Smtp_Live
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- Smtp_Mail_Ru
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- Smtp_Yahoo
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- SolarURL
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- SpyEyeMutexes
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- SpyeyeURL
2017-05-15 18:19:36,349 [cuckoo.core.startup] DEBUG:     |-- SpynetRat
2017-05-15 18:19:36,350 [cuckoo.core.startup] DEBUG:     |-- Spyrecorder
2017-05-15 18:19:36,350 [cuckoo.core.startup] DEBUG:     |-- StackPivot
2017-05-15 18:19:36,350 [cuckoo.core.startup] DEBUG:     |-- StackPivotDllLoad
2017-05-15 18:19:36,350 [cuckoo.core.startup] DEBUG:     |-- Staser
2017-05-15 18:19:36,350 [cuckoo.core.startup] DEBUG:     |-- StealthChildProc
2017-05-15 18:19:36,350 [cuckoo.core.startup] DEBUG:     |-- StealthHiddenExtension
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- StealthHiddenFile
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- StealthHiddenIcons
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- StopsService
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- SunbeltDetectFiles
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- SunBeltSandboxDetect
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- SuspiciousPowershell
2017-05-15 18:19:36,351 [cuckoo.core.startup] DEBUG:     |-- SuspiciousWriteEXE
2017-05-15 18:19:36,352 [cuckoo.core.startup] DEBUG:     |-- SweetorangeMutexes
2017-05-15 18:19:36,352 [cuckoo.core.startup] DEBUG:     |-- Swrort
2017-05-15 18:19:36,352 [cuckoo.core.startup] DEBUG:     |-- SystemInfo
2017-05-15 18:19:36,352 [cuckoo.core.startup] DEBUG:     |-- SystemMetrics
2017-05-15 18:19:36,352 [cuckoo.core.startup] DEBUG:     |-- TapiDpMutexes
2017-05-15 18:19:36,352 [cuckoo.core.startup] DEBUG:     |-- TDSSBackdoor
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- TeamviewerRat
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- ThreatTrackDetectFiles
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- TinbaMutexes
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- TnegaMutexes
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- Tor
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- TorHiddenService
2017-05-15 18:19:36,353 [cuckoo.core.startup] DEBUG:     |-- Travnet
2017-05-15 18:19:36,354 [cuckoo.core.startup] DEBUG:     |-- Trogbot
2017-05-15 18:19:36,354 [cuckoo.core.startup] DEBUG:     |-- TrojanJorik
2017-05-15 18:19:36,354 [cuckoo.core.startup] DEBUG:     |-- TrojanLethic
2017-05-15 18:19:36,354 [cuckoo.core.startup] DEBUG:     |-- TrojanLethic
2017-05-15 18:19:36,354 [cuckoo.core.startup] DEBUG:     |-- trojanmrblack
2017-05-15 18:19:36,354 [cuckoo.core.startup] DEBUG:     |-- TrojanRedosru
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- TrojanSysn
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- trojanyoddos
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- TufikMutexes
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- Turkojan
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- TurlaCarbon
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- UFRStealer
2017-05-15 18:19:36,355 [cuckoo.core.startup] DEBUG:     |-- Unhook
2017-05-15 18:19:36,356 [cuckoo.core.startup] DEBUG:     |-- Upatre
2017-05-15 18:19:36,356 [cuckoo.core.startup] DEBUG:     |-- UpatreTDMutexes
2017-05-15 18:19:36,356 [cuckoo.core.startup] DEBUG:     |-- UPXCompressed
2017-05-15 18:19:36,356 [cuckoo.core.startup] DEBUG:     |-- UrkShortCN
2017-05-15 18:19:36,356 [cuckoo.core.startup] DEBUG:     |-- URLSpy
2017-05-15 18:19:36,356 [cuckoo.core.startup] DEBUG:     |-- UroburosFile
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- UroburosMutexes
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- Urxbot
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- UsesWindowsUtilities
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- Vanbot
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- VBInject
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectACPI
2017-05-15 18:19:36,357 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectDevices
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectFiles
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectKeys
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectProvname
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectWindow
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- Vertex
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- VertexSolarURL
2017-05-15 18:19:36,358 [cuckoo.core.startup] DEBUG:     |-- VirtualPCDetect
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- VirtualPCIllegalInstruction
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- Virut
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- VMFirmware
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- VMPPacked
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- VMWareDetectFiles
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- VMWareDetectKeys
2017-05-15 18:19:36,359 [cuckoo.core.startup] DEBUG:     |-- VMWareInInstruction
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VncMutexes
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VNLoaderURL
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VolDevicetree1
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VolHandles1
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VolLdrModules1
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VolLdrModules2
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VolMalfind1
2017-05-15 18:19:36,360 [cuckoo.core.startup] DEBUG:     |-- VolModscan1
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- VolSvcscan1
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- VolSvcscan2
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- VolSvcscan3
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- VPCDetectKeys
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- Wakbot
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- WarbotURL
2017-05-15 18:19:36,361 [cuckoo.core.startup] DEBUG:     |-- Whimoo
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- Win32ProcessCreate
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- WineDetect
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- WinSCP
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- WinSxsBot
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- WMIAntiVM
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- WormAllaple
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- WormKolabc
2017-05-15 18:19:36,362 [cuckoo.core.startup] DEBUG:     |-- XenDetectKeys
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     |-- XtremeRAT
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     |-- Xworm
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     |-- Zegost
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     |-- ZeusMutexes
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     |-- ZeusP2P
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     |-- ZeusURL
2017-05-15 18:19:36,363 [cuckoo.core.startup] DEBUG:     `-- ZoneID
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG: Imported "reporting" modules:
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG:     |-- ElasticSearch
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG:     |-- Feedback
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG:     |-- JsonDump
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG:     |-- Mattermost
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG:     |-- MISP
2017-05-15 18:19:36,364 [cuckoo.core.startup] DEBUG:     |-- Moloch
2017-05-15 18:19:36,365 [cuckoo.core.startup] DEBUG:     |-- MongoDB
2017-05-15 18:19:36,365 [cuckoo.core.startup] DEBUG:     |-- Notification
2017-05-15 18:19:36,365 [cuckoo.core.startup] DEBUG:     `-- SingleFile
2017-05-15 18:19:36,365 [cuckoo.core.startup] DEBUG: Checking for locked tasks..
2017-05-15 18:19:36,378 [cuckoo.core.startup] DEBUG: Checking for pending service tasks..
2017-05-15 18:19:36,386 [cuckoo.core.startup] DEBUG: Initializing Yara...
2017-05-15 18:19:36,388 [cuckoo.core.startup] DEBUG:     |-- binaries APT_APT10.yar
2017-05-15 18:19:36,388 [cuckoo.core.startup] DEBUG:     |-- binaries APT_APT17.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_APT29_Grizzly_Steppe.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_APT3102.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_APT9002.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Backspace.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Bestia.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Blackenergy.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Bluetermite_Emdivi.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_C16.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Carbanak.yar
2017-05-15 18:19:36,389 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Careto.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Casper.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_CheshireCat.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Cloudduke.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Codoso.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_DeepPanda_Anthem.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_DeputyDog.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Derusbi.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Dubnium.yar
2017-05-15 18:19:36,390 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Duqu2.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_EQUATIONGRP.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Emissary.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Equation.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_FVEY_ShadowBrokers_Jan17_Screen_Strings.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_FiveEyes.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Grasshopper.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Greenbug.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Grizzlybear_uscert.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_HackingTeam.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Hellsing.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Hikit.yar
2017-05-15 18:19:36,391 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Irontiger.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Kaba.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Ke3Chang_TidePool.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_KeyBoy.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_LotusBlossom.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Minidionis.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Mirage.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Molerats.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Mongall.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_NGO.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_OPCleaver.yar
2017-05-15 18:19:36,392 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Oilrig.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_OpClandestineWolf.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_OpDustStorm.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_OpPotao.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_PCclient.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Passcv.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Pipcreat.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Platinum.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Poseidon_Group.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Prikormka.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_PutterPanda.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Regin.yar
2017-05-15 18:19:36,393 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Scarab_Scieron.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Seaduke.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Snowglobe_Babar.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Sofacy_Bundestag.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Sofacy_Fysbis.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Sofacy_Jun16.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Sphinx_Moth.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Stuxnet.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Terracota.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_ThreatGroup3390.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_TradeSecret.yar
2017-05-15 18:19:36,394 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Turla_RUAG.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_UP007_SLServer.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Unit78020.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Waterbug.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_WildNeutron.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Windigo_Onimiki.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_Winnti.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_WoolenGoldfish.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_eqgrp_apr17.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_fancybear_dnc.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries APT_furtim.yar
2017-05-15 18:19:36,395 [cuckoo.core.startup] DEBUG:     |-- binaries EXPERIMENTAL_Beef.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries GEN_PowerShell.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries JJencode.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries Javascript_exploit_and_obfuscation.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Alina.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Andromeda.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Athena.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Atmos.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_BackdoorSSH.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Backoff.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Batel.yar
2017-05-15 18:19:36,396 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_BlackRev.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_BlackWorm.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Boouset.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Bublik.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Buzus_Softpulse.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_CAP_HookExKeylogger.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Chicken.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Citadel.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Cloaking.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Cookies.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Corkow.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Cxpid.yar
2017-05-15 18:19:36,397 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Cythosia.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_DDoSTf.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Derkziel.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Dexter.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_DiamondFox.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_DirtJumper.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Elex.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Elknot.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Empire.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Enfal.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Exploit_UAC_Elevators.yar
2017-05-15 18:19:36,398 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Ezcob.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_F0xy.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_FakeM.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Fareit.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Favorite.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Furtim.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Genome.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Glasses.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Gozi.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Grozlex.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Hajime.yar
2017-05-15 18:19:36,399 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Hsdfihdf_banking.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_IMuler.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Install11.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Intel_Virtualization.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Jolob_Backdoor.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Kelihos.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Korlia.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Korplug.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Kovter.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Kraken.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_LURK0.yar
2017-05-15 18:19:36,400 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Lateral_Movement.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Lenovo_Superfish.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_LinuxMoose.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_LostDoor.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_LuckyCat.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_MacControl.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Madness.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Magento_backend.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Magento_frontend.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Magento_suspicious.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Mailers.yar
2017-05-15 18:19:36,401 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Miancha.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_MiniAsp3_mem.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Mirai.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Miscelanea_Linux.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_NSFree.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Naspyupdate.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_NionSpy.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Notepad.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_OSX_Leverage.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Odinaff.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Olyx.yar
2017-05-15 18:19:36,402 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_PE_sections.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_PittyTiger.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Ponmocup.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Pony.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_PubSab.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Pyinstaller.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Regsubdat.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Retefe.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Rockloader.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Rooter.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Rovnix.yar
2017-05-15 18:19:36,403 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Safenet.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Sakurel.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Sayad.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Scarhikn.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Sendsafe.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Shamoon.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Shifu.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Skeleton.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Spora.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Sqlite.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Stealer.yar
2017-05-15 18:19:36,404 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Surtr.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_T5000.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Tedroo.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Tinba.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Torte_ELF.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_TreasureHunt.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Upatre.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Urausy.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Vidgrab.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Wabot.yar
2017-05-15 18:19:36,405 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Warp.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Wimmie.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_XOR_DDos.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Yayih.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Zegost.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_Zeus.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_viotto_keylogger.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries MALW_xDedic_marketplace.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries POS.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries POS_Bernhard.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries POS_BruteforcingBot.yar
2017-05-15 18:19:36,406 [cuckoo.core.startup] DEBUG:     |-- binaries POS_Easterjack.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries POS_FastPOS.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries POS_LogPOS.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries POS_MalumPOS.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries POS_Mozart.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_.CRYPTXXX.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_777.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Alpha.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Cerber.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Comodosec.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Crypren.yar
2017-05-15 18:19:36,407 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Cryptolocker.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_DMALocker.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_GoldenEye.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Locky.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Petya.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Satana.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Stampado.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Telefonica.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_TeslaCrypt.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RANSOM_Tox.yar
2017-05-15 18:19:36,408 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Adwind.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Adzok.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_BlackShades.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Bolonyokte.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Cerberus.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_DarkComet.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_FlyingKitten.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Gh0st.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Gholee.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Glass.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Havex.yar
2017-05-15 18:19:36,409 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Hizor.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Indetectables.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Inocnation.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Meterpreter_Reverse_Tcp.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Nanocore.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_NetwiredRC.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Njrat.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_PlugX.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_PoisonIvy.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Ratdecoders.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Sakula.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_ShadowTech.yar
2017-05-15 18:19:36,410 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Shim.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_Terminator.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_ZoxPNG.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_jRAT.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_xRAT.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries RAT_xRAT20.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_Chinese_Hacktools.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_Dubrute.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_FinFisher_.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_Gen_powerkatz.yar
2017-05-15 18:19:36,411 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_PassTheHash.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_Pwdump.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_THOR_HackTools.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_Wineggdrop.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries TOOLKIT_exe2hex_payload.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries antidebug.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries crypto.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries packer.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     |-- binaries packer_compiler_signatures.yar
2017-05-15 18:19:36,412 [cuckoo.core.startup] DEBUG:     `-- binaries peid.yar
2017-05-15 18:19:37,199 [cuckoo.core.resultserver] DEBUG: ResultServer running on 172.16.0.1:2042.
2017-05-15 18:19:37,200 [cuckoo.core.scheduler] INFO: Using "esx" as machine manager
2017-05-15 18:19:37,562 [cuckoo.common.abstracts] DEBUG: Getting status for analysis_win7
2017-05-15 18:19:37,573 [cuckoo.common.abstracts] DEBUG: Getting status for analysis_winxp
2017-05-15 18:19:37,595 [cuckoo.core.scheduler] INFO: Loaded 2 machine/s
2017-05-15 18:19:37,637 [cuckoo.core.scheduler] INFO: Waiting for analysis tasks.
2017-05-15 18:19:59,167 [cuckoo.core.scheduler] DEBUG: Processing task #9
2017-05-15 18:19:59,179 [cuckoo.core.scheduler] INFO: Starting analysis of FILE "cerber.exe" (task #9, options "procmemdump=yes,route=internet")
2017-05-15 18:19:59,210 [cuckoo.core.scheduler] INFO: Task #9: acquired machine WindowsXP (label=analysis_winxp)
2017-05-15 18:19:59,219 [cuckoo.auxiliary.mitm] INFO: Started mitm interception with PID 3042 (ip=172.16.0.1, port=50000).
2017-05-15 18:19:59,219 [cuckoo.core.plugins] DEBUG: Started auxiliary module: MITM
2017-05-15 18:19:59,228 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3043 (interface=ens160, host=172.16.0.3, pcap=/home/cuckoo/.cuckoo/storage/analyses/9/dump.pcap)
2017-05-15 18:19:59,228 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer
2017-05-15 18:19:59,253 [cuckoo.common.abstracts] DEBUG: Starting machine analysis_winxp
2017-05-15 18:19:59,254 [cuckoo.common.abstracts] DEBUG: Getting status for analysis_winxp
2017-05-15 18:19:59,289 [cuckoo.common.abstracts] DEBUG: Using snapshot clean for virtual machine analysis_winxp
2017-05-15 18:19:59,874 [cuckoo.common.abstracts] DEBUG: Getting status for analysis_winxp
2017-05-15 18:20:00,039 [cuckoo.core.guest] INFO: Starting analysis on guest (id=WindowsXP, ip=172.16.0.3)
2017-05-15 18:20:00,361 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.7 (id=WindowsXP, ip=172.16.0.3)
2017-05-15 18:20:00,395 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=WindowsXP, ip=172.16.0.3, monitor=latest, size=3822402)
2017-05-15 18:20:00,841 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:01,111 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.
2017-05-15 18:20:01,849 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:02,855 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:03,861 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:04,869 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:05,876 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:06,882 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:07,888 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:08,935 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:09,941 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:10,947 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:11,953 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:12,959 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:13,965 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:14,972 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:15,981 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:16,987 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:17,993 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:19,064 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:20,071 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:21,079 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:22,087 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:23,126 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:24,132 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:25,138 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:26,145 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:27,151 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:28,157 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:29,164 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:30,172 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:31,180 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:32,187 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:33,192 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:34,199 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:35,205 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:36,211 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:37,217 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:38,224 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:39,230 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:40,236 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:41,243 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:42,249 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:43,255 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:44,261 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:45,267 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:46,273 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:47,279 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:48,285 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:49,293 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:50,299 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:51,305 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:52,313 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:53,320 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:54,330 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:55,336 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:56,343 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:57,392 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:58,487 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:20:59,495 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:00,501 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:01,515 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:02,528 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:03,534 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:04,540 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:05,547 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:06,553 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:07,564 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:08,570 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:09,578 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:10,585 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:11,593 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:12,601 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:13,607 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:14,613 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:15,620 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:16,626 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:17,675 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:18,706 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:19,712 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:20,768 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:21,773 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:22,780 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:23,830 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:24,924 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:25,930 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:26,936 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:27,942 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:28,948 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:29,954 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:30,961 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:31,967 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:33,002 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:34,008 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:35,013 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:36,019 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:37,027 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:38,033 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:39,041 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:40,046 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:41,052 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:42,158 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:43,164 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:44,170 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:45,190 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:46,314 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:47,322 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:48,329 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:49,335 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:50,342 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:51,348 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:52,354 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:53,362 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:54,394 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:55,400 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:56,407 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:57,415 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:58,424 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:21:59,432 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:00,439 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:01,445 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:02,452 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:03,458 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:04,464 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:05,470 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:06,478 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:07,485 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:08,503 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:09,511 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:10,517 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:11,525 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:12,533 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:13,539 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:14,545 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:15,553 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:16,561 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:17,567 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:18,573 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:19,579 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:20,586 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:21,592 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:22,598 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:23,604 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:24,610 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:25,617 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:26,623 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:27,629 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:28,635 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:29,643 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:30,650 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:31,656 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:32,662 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:33,670 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:34,676 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:35,683 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:36,689 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:37,695 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:38,703 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:39,709 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:40,715 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:41,721 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:42,784 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:43,878 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:44,972 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:45,977 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:46,984 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:48,034 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:49,042 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:50,047 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:51,097 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:52,103 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:53,109 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:54,159 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:55,165 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:56,171 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:57,222 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:58,228 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:22:59,234 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:23:00,285 [cuckoo.core.guest] DEBUG: WindowsXP: analysis still processing
2017-05-15 18:23:01,286 [cuckoo.core.scheduler] ERROR: Error from the Cuckoo Guest: The analysis hit the critical timeout, terminating.
2017-05-15 18:23:01,291 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: MITM
2017-05-15 18:23:01,326 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2017-05-15 18:23:01,327 [cuckoo.common.abstracts] DEBUG: Stopping machine analysis_winxp
2017-05-15 18:23:01,327 [cuckoo.common.abstracts] DEBUG: Getting status for analysis_winxp
2017-05-15 18:23:01,445 [cuckoo.common.abstracts] DEBUG: Getting status for analysis_winxp
2017-05-15 18:23:02,029 [cuckoo.core.scheduler] DEBUG: Released database task #9
2017-05-15 18:23:02,049 [cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,050 [cuckoo.processing.behavior] WARNING: Analysis results folder does not contain any behavior log files.
2017-05-15 18:23:02,050 [cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,051 [cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,051 [cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,052 [cuckoo.core.plugins] DEBUG: Executed processing module "MetaInfo" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,052 [cuckoo.core.plugins] DEBUG: Executed processing module "ProcessMemory" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,053 [cuckoo.core.plugins] DEBUG: Executed processing module "Procmon" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,053 [cuckoo.core.plugins] DEBUG: Executed processing module "Screenshots" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,415 [cuckoo.core.plugins] DEBUG: Executed processing module "Static" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,441 [cuckoo.core.plugins] DEBUG: Executed processing module "Strings" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,745 [cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:02,748 [cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:42,783 [cuckoo.processing.virustotal] WARNING: Error fetching results from VirusTotal for "a60a0361c5168dc14f10d22061030091940ef68a8da3abbaac076eaf92aad81f": Unable to fetch VirusTotal results: MaxRetryError("HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /vtapi/v2/file/report (Caused by NewConnectionError('<requests.packages.urllib3.connection.VerifiedHTTPSConnection object at 0x7f0bceecfe10>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',))",)
2017-05-15 18:23:42,783 [cuckoo.core.plugins] DEBUG: Executed processing module "VirusTotal" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:42,784 [cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:42,787 [cuckoo.core.plugins] DEBUG: Executed processing module "Debug" on analysis at "/home/cuckoo/.cuckoo/storage/analyses/9"
2017-05-15 18:23:42,796 [cuckoo.core.plugins] DEBUG: Running 421 signatures
2017-05-15 18:23:42,936 [cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_entropy
2017-05-15 18:23:42,969 [cuckoo.core.plugins] DEBUG: Executed reporting module "ElasticSearch"
2017-05-15 18:23:42,974 [cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"
May 15 18:23:42 main.c:599 main(): THREAD 0x7f0a57344780
2017-05-15 18:23:43,892 [cuckoo.core.plugins] DEBUG: Executed reporting module "Moloch"
2017-05-15 18:23:43,906 [cuckoo.core.plugins] DEBUG: Executed reporting module "MongoDB"
2017-05-15 18:23:43,906 [cuckoo.core.scheduler] INFO: Task #9: reports generation completed (path=/home/cuckoo/.cuckoo/storage/analyses/9)
2017-05-15 18:23:43,922 [cuckoo.core.scheduler] INFO: Task #9: analysis procedure completed
jingkang99 commented 7 years ago

it was fixed, but seems happened again?

jbremer commented 7 years ago

Would seem so, yes.. not sure why yet.

jbremer commented 7 years ago

Any progress here @wirehack7?

wirehack7 commented 7 years ago

Sorry @jbremer, I'm on travel and my OpenVM machine died. Cannot reach my ESXi at home atm. Will post here as soon as I can.

jbremer commented 6 years ago

Any update here @wirehack7 ? Thanks.

wirehack7 commented 6 years ago

Don't have my ESXi with me, sorry. ETA would be January, then I can have a look again. Again, sorry for the delay

jbremer commented 6 years ago

No worries @wirehack7, it's been January btw :-)

wirehack7 commented 6 years ago

I know @jbremer, lemme find my XP ISO and key again :)