search

kevoreilly / CAPEv2

Malware Configuration And Payload Extraction
https://capesandbox.com/analysis/
Other
1.88k stars 402 forks source link

Missing Memory Tab in Analysis Webpage(?) #1147

Closed helloworld104 closed 1 year ago

helloworld104 commented 1 year ago

About accounts on capesandbox.com

This is opensource and you getting free support so be friendly!

Prerequisites

Please answer the following questions for yourself before submitting an issue.

Expected Behavior

Please describe the behavior you are expecting. If your samples(x64) stuck in pending ensure that you set tags=x64 in hypervisor conf for x64 vms

I saw that there are several HTML files in CAPEv2/web/templates/analysis/memory which should display information about the memory dump e.g. pslist, privs, etc. I have enabled memory dump and the analyses results include the "memory.dmp" file. I expect there to be a tab for memory, just like how there are tabs for behavioral and network analysis...

Current Behavior

What is the current behavior?

I can't seem to find the memory tab in the analysis page: Screenshot from 2022-09-15 14-14-10 How do I enable the memory HTML pages?

github-actions[bot] commented 1 year ago

@capeuser21: hello! :wave:

This issue is being automatically closed because it does not follow the issue template.

This is open source project! So please apreciate our time that we sacrify from other thing that we could enjoy, instead of asking boring things over and over.

kevoreilly commented 1 year ago

Can I check how you are enabling this option?

helloworld104 commented 1 year ago

previously my analyses did not have the "memory.dmp", so i reviewed the documentation and followed the steps to enable memory in processing.conf and memory_dump in cuckoo.conf. Now I am able to see the "memory.dmp" file in the analyses folder but I cant see any information related to the memory dump and Volatility in the webpage, which I thought should be present since there were the relevant HTML templates (example below) Screenshot from 2022-09-15 14-46-55

kevoreilly commented 1 year ago

So you are referring to full system dumps as opposed to full process dumps. The process memory tab in the web ui is for the latter.

kevoreilly commented 1 year ago

Mainstream cape has never used full system dumps or vol - this was custom made by @doomedraven. I am not sure this is supported any more. Fundamentally using volatility is at odds with cape's whole raison d'être.

kevoreilly commented 1 year ago

I have no idea. doomed is the only man who knows.

Why do you want volatility? It means cape is failing.

doomedraven commented 1 year ago

it should have, but do you have properly configured volatility?

doomedraven commented 1 year ago

kevin is not about cape failing, is about preferences of everyone, you know how long i used it ;)

kevoreilly commented 1 year ago

The whole point of cape is so that you don't need another massive tool like vol because cape already captured everything you could want.

helloworld104 commented 1 year ago

it should have, but do you have properly configured volatility?

i believe so, is there a way to verify whether volatility is working as expected?

helloworld104 commented 1 year ago

I have no idea. doomed is the only man who knows.

Why do you want volatility? It means cape is failing.

i thought it would be good to be able to view the memory dump information in readable format, but I cant seem to find the memory HTML pages in the web UI

kevoreilly commented 1 year ago

Not to mention cape's design assumes there might be interesting stuff to capture during the execution that is no longer present at the end. Cape attempts to capture payloads before execution or shortly after it begins.

doomedraven commented 1 year ago

yes memdumps in webpage, go yo mongo or json report and verify if you have data there + you might have something in logs about that, maybe reprocess in debug mode with process.py -r x -d

helloworld104 commented 1 year ago

yes, my json report does have data. i have also reprocessed in debug mode and the memory module seems to run normally as shown below:

XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use MS Excel) DEBUG:lib.cuckoo.core.plugins:Executing processing module "CAPE" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:09:44,028 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "CAPE" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:PIL.Image:Importing BmpImagePlugin 2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing BmpImagePlugin DEBUG:PIL.Image:Importing BufrStubImagePlugin 2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing BufrStubImagePlugin DEBUG:PIL.Image:Importing CurImagePlugin 2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing CurImagePlugin DEBUG:PIL.Image:Importing DcxImagePlugin 2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing DcxImagePlugin DEBUG:PIL.Image:Importing DdsImagePlugin 2022-09-15 15:09:45,634 [Task 28] [PIL.Image] DEBUG: Importing DdsImagePlugin DEBUG:PIL.Image:Importing EpsImagePlugin 2022-09-15 15:09:45,634 [Task 28] [PIL.Image] DEBUG: Importing EpsImagePlugin DEBUG:PIL.Image:Importing FitsStubImagePlugin 2022-09-15 15:09:45,634 [Task 28] [PIL.Image] DEBUG: Importing FitsStubImagePlugin DEBUG:PIL.Image:Importing FliImagePlugin 2022-09-15 15:09:45,635 [Task 28] [PIL.Image] DEBUG: Importing FliImagePlugin DEBUG:PIL.Image:Importing FpxImagePlugin 2022-09-15 15:09:45,635 [Task 28] [PIL.Image] DEBUG: Importing FpxImagePlugin DEBUG:PIL.Image:Importing FtexImagePlugin 2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing FtexImagePlugin DEBUG:PIL.Image:Importing GbrImagePlugin 2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing GbrImagePlugin DEBUG:PIL.Image:Importing GifImagePlugin 2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing GifImagePlugin DEBUG:PIL.Image:Importing GribStubImagePlugin 2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing GribStubImagePlugin DEBUG:PIL.Image:Importing Hdf5StubImagePlugin 2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing Hdf5StubImagePlugin DEBUG:PIL.Image:Importing IcnsImagePlugin 2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing IcnsImagePlugin DEBUG:PIL.Image:Importing IcoImagePlugin 2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing IcoImagePlugin DEBUG:PIL.Image:Importing ImImagePlugin 2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing ImImagePlugin DEBUG:PIL.Image:Importing ImtImagePlugin 2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing ImtImagePlugin DEBUG:PIL.Image:Importing IptcImagePlugin 2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing IptcImagePlugin DEBUG:PIL.Image:Importing JpegImagePlugin 2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing JpegImagePlugin DEBUG:PIL.Image:Importing Jpeg2KImagePlugin 2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing Jpeg2KImagePlugin DEBUG:PIL.Image:Importing McIdasImagePlugin 2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing McIdasImagePlugin DEBUG:PIL.Image:Importing MicImagePlugin 2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MicImagePlugin DEBUG:PIL.Image:Importing MpegImagePlugin 2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MpegImagePlugin DEBUG:PIL.Image:Importing MpoImagePlugin 2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MpoImagePlugin DEBUG:PIL.Image:Importing MspImagePlugin 2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MspImagePlugin DEBUG:PIL.Image:Importing PalmImagePlugin 2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PalmImagePlugin DEBUG:PIL.Image:Importing PcdImagePlugin 2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PcdImagePlugin DEBUG:PIL.Image:Importing PcxImagePlugin 2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PcxImagePlugin DEBUG:PIL.Image:Importing PdfImagePlugin 2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PdfImagePlugin DEBUG:PIL.Image:Importing PixarImagePlugin 2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PixarImagePlugin DEBUG:PIL.Image:Importing PngImagePlugin 2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PngImagePlugin DEBUG:PIL.Image:Importing PpmImagePlugin 2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PpmImagePlugin DEBUG:PIL.Image:Importing PsdImagePlugin 2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PsdImagePlugin DEBUG:PIL.Image:Importing SgiImagePlugin 2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing SgiImagePlugin DEBUG:PIL.Image:Importing SpiderImagePlugin 2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing SpiderImagePlugin DEBUG:PIL.Image:Importing SunImagePlugin 2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing SunImagePlugin DEBUG:PIL.Image:Importing TgaImagePlugin 2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing TgaImagePlugin DEBUG:PIL.Image:Importing TiffImagePlugin 2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing TiffImagePlugin DEBUG:PIL.Image:Importing WebPImagePlugin 2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing WebPImagePlugin DEBUG:PIL.Image:Image: failed to import WebPImagePlugin: cannot import name '_webp' from 'PIL' (/home/cape/.cache/pypoetry/virtualenvs/capev2-t2x27zRb-py3.8/lib/python3.8/site-packages/PIL/init.py) 2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Image: failed to import WebPImagePlugin: cannot import name '_webp' from 'PIL' (/home/cape/.cache/pypoetry/virtualenvs/capev2-t2x27zRb-py3.8/lib/python3.8/site-packages/PIL/init.py) DEBUG:PIL.Image:Importing WmfImagePlugin 2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing WmfImagePlugin DEBUG:PIL.Image:Importing XbmImagePlugin 2022-09-15 15:09:45,643 [Task 28] [PIL.Image] DEBUG: Importing XbmImagePlugin DEBUG:PIL.Image:Importing XpmImagePlugin 2022-09-15 15:09:45,643 [Task 28] [PIL.Image] DEBUG: Importing XpmImagePlugin DEBUG:PIL.Image:Importing XVThumbImagePlugin 2022-09-15 15:09:45,644 [Task 28] [PIL.Image] DEBUG: Importing XVThumbImagePlugin DEBUG:lib.cuckoo.core.plugins:Executing processing module "AnalysisInfo" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:10:14,896 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "AnalysisInfo" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "BehaviorAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:10:14,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "BehaviorAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "Curtain" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:10:16,974 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Curtain" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "Debug" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:10:16,975 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Debug" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "Dropped" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:10:16,977 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Dropped" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "Memory" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:10:39,656 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Memory" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "NetworkAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:12:32,525 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "NetworkAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "ProcDump" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:12:32,666 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "ProcDump" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "Suricata" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:12:37,002 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Suricata" on analysis at "/opt/CAPEv2/storage/analyses/28" WARNING:modules.processing.suricata:Unable to Run Suricata: Conf File /etc/suricata/suricata.yaml does not exist 2022-09-15 15:12:37,002 [Task 28] [modules.processing.suricata] WARNING: Unable to Run Suricata: Conf File /etc/suricata/suricata.yaml does not exist DEBUG:lib.cuckoo.core.plugins:Executing processing module "TargetInfo" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:12:37,003 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "TargetInfo" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "script_log_processing" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:12:37,772 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "script_log_processing" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Executing processing module "ProcessMemory" on analysis at "/opt/CAPEv2/storage/analyses/28" 2022-09-15 15:12:37,773 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "ProcessMemory" on analysis at "/opt/CAPEv2/storage/analyses/28" DEBUG:lib.cuckoo.core.plugins:Applying signature overlays for signatures: creates_exe 2022-09-15 15:12:47,242 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Applying signature overlays for signatures: creates_exe DEBUG:lib.cuckoo.core.plugins:Running 289 evented signatures 2022-09-15 15:12:47,244 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running 289 evented signatures DEBUG:lib.cuckoo.core.plugins: |-- compression 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- compression DEBUG:lib.cuckoo.core.plugins: |-- decryption 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- decryption DEBUG:lib.cuckoo.core.plugins: |-- doppelganging 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- doppelganging DEBUG:lib.cuckoo.core.plugins: |-- evil_grab 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- evil_grab DEBUG:lib.cuckoo.core.plugins: |-- injection_inter_process 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_inter_process DEBUG:lib.cuckoo.core.plugins: |-- injection_create_remote_thread 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_create_remote_thread DEBUG:lib.cuckoo.core.plugins: |-- injection_process_hollowing 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_process_hollowing DEBUG:lib.cuckoo.core.plugins: |-- injection_set_window_long 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_set_window_long DEBUG:lib.cuckoo.core.plugins: |-- plugx 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- plugx DEBUG:lib.cuckoo.core.plugins: |-- reg_binary 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- reg_binary DEBUG:lib.cuckoo.core.plugins: |-- transacted_hollowing 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- transacted_hollowing DEBUG:lib.cuckoo.core.plugins: |-- unpacker 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- unpacker DEBUG:lib.cuckoo.core.plugins: |-- alphacrypt_behavior 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- alphacrypt_behavior DEBUG:lib.cuckoo.core.plugins: |-- andromeda_behavior 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- andromeda_behavior DEBUG:lib.cuckoo.core.plugins: |-- anomalous_deletefile 2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- anomalous_deletefile DEBUG:lib.cuckoo.core.plugins: |-- antiav_360_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_360_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_ahnlab_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_ahnlab_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_avast_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_avast_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_bitdefender_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_bitdefender_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_bullgaurd_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_bullgaurd_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_emsisoft_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_emsisoft_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_qurb_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_qurb_libs DEBUG:lib.cuckoo.core.plugins: |-- antiav_servicestop 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_servicestop DEBUG:lib.cuckoo.core.plugins: |-- antidebug_addvectoredexceptionhandler 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_addvectoredexceptionhandler DEBUG:lib.cuckoo.core.plugins: |-- antiav_apioverride_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_apioverride_libs DEBUG:lib.cuckoo.core.plugins: |-- antidebug_checkremotedebuggerpresent 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_checkremotedebuggerpresent DEBUG:lib.cuckoo.core.plugins: |-- antidebug_debugactiveprocess 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_debugactiveprocess DEBUG:lib.cuckoo.core.plugins: |-- antidebug_gettickcount 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_gettickcount DEBUG:lib.cuckoo.core.plugins: |-- antidebug_guardpages 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_guardpages DEBUG:lib.cuckoo.core.plugins: |-- antidebug_ntcreatethreadex 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_ntcreatethreadex DEBUG:lib.cuckoo.core.plugins: |-- antiav_nthookengine_libs 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_nthookengine_libs DEBUG:lib.cuckoo.core.plugins: |-- antidebug_ntsetinformationthread 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_ntsetinformationthread DEBUG:lib.cuckoo.core.plugins: |-- antidebug_outputdebugstring 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_outputdebugstring DEBUG:lib.cuckoo.core.plugins: |-- antidebug_setunhandledexceptionfilter 2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_setunhandledexceptionfilter DEBUG:lib.cuckoo.core.plugins: |-- antidebug_windows 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_windows DEBUG:lib.cuckoo.core.plugins: |-- antiemu_wine_func 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiemu_wine_func DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_check_userdomain 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_check_userdomain DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_cuckoo 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_cuckoo DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_cuckoocrash 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_cuckoocrash DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_foregroundwindows 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_foregroundwindows DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_mouse_hook 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_mouse_hook DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_restart 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_restart DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sboxie_libs 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sboxie_libs DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sboxie_objects 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sboxie_objects DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_script_timer 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_script_timer DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sleep 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sleep DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sunbelt_libs 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sunbelt_libs DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_suspend 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_suspend DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_unhook 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_unhook DEBUG:lib.cuckoo.core.plugins: |-- antivm_directory_objects 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_directory_objects DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_disk 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_disk DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_disk_setupapi 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_disk_setupapi DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_scsi 2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_scsi DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_services 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_services DEBUG:lib.cuckoo.core.plugins: |-- antivm_network_adapters 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_network_adapters DEBUG:lib.cuckoo.core.plugins: |-- antivm_vbox_libs 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vbox_libs DEBUG:lib.cuckoo.core.plugins: |-- antivm_vbox_provname 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vbox_provname DEBUG:lib.cuckoo.core.plugins: |-- antivm_vbox_window 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vbox_window DEBUG:lib.cuckoo.core.plugins: |-- antivm_vmware_events 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vmware_events DEBUG:lib.cuckoo.core.plugins: |-- antivm_vmware_libs 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vmware_libs DEBUG:lib.cuckoo.core.plugins: |-- api_spamming 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- api_spamming DEBUG:lib.cuckoo.core.plugins: |-- banker_prinimalka 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- banker_prinimalka DEBUG:lib.cuckoo.core.plugins: |-- bcdedit_command 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- bcdedit_command DEBUG:lib.cuckoo.core.plugins: |-- betabot_behavior 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- betabot_behavior DEBUG:lib.cuckoo.core.plugins: |-- bootkit 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- bootkit DEBUG:lib.cuckoo.core.plugins: |-- potential_overwrite_mbr 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- potential_overwrite_mbr DEBUG:lib.cuckoo.core.plugins: |-- suspicious_ioctl_scsipassthough 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- suspicious_ioctl_scsipassthough DEBUG:lib.cuckoo.core.plugins: |-- browser_needed 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- browser_needed DEBUG:lib.cuckoo.core.plugins: |-- browser_scanbox 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- browser_scanbox DEBUG:lib.cuckoo.core.plugins: |-- firefox_disables_process_tab 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- firefox_disables_process_tab DEBUG:lib.cuckoo.core.plugins: |-- regsvr32_squiblydoo_dll_load 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- regsvr32_squiblydoo_dll_load DEBUG:lib.cuckoo.core.plugins: |-- uac_bypass_cmstp 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- uac_bypass_cmstp DEBUG:lib.cuckoo.core.plugins: |-- uac_bypass_eventvwr 2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- uac_bypass_eventvwr DEBUG:lib.cuckoo.core.plugins: |-- cerber_behavior 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cerber_behavior DEBUG:lib.cuckoo.core.plugins: |-- chimera_behavior 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- chimera_behavior DEBUG:lib.cuckoo.core.plugins: |-- clickfraud_cookies 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- clickfraud_cookies DEBUG:lib.cuckoo.core.plugins: |-- clickfraud_volume 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- clickfraud_volume DEBUG:lib.cuckoo.core.plugins: |-- dotnet_code_compile 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dotnet_code_compile DEBUG:lib.cuckoo.core.plugins: |-- creates_largekey 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- creates_largekey DEBUG:lib.cuckoo.core.plugins: |-- creates_nullvalue 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- creates_nullvalue DEBUG:lib.cuckoo.core.plugins: |-- lsass_credential_dumping 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- lsass_credential_dumping DEBUG:lib.cuckoo.core.plugins: |-- critical_process 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- critical_process DEBUG:lib.cuckoo.core.plugins: |-- generates_crypto_key 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- generates_crypto_key DEBUG:lib.cuckoo.core.plugins: |-- cryptowall_behavior 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cryptowall_behavior DEBUG:lib.cuckoo.core.plugins: |-- cve_2014_6332 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2014_6332 DEBUG:lib.cuckoo.core.plugins: |-- cve_2015_2419_js 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2015_2419_js DEBUG:lib.cuckoo.core.plugins: |-- cve_2016-0189 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2016-0189 DEBUG:lib.cuckoo.core.plugins: |-- cve_2016_7200 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2016_7200 DEBUG:lib.cuckoo.core.plugins: |-- dead_connect 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dead_connect DEBUG:lib.cuckoo.core.plugins: |-- dead_link 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dead_link DEBUG:lib.cuckoo.core.plugins: |-- debugs_self 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- debugs_self DEBUG:lib.cuckoo.core.plugins: |-- decoy_document 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- decoy_document DEBUG:lib.cuckoo.core.plugins: |-- decoy_image 2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- decoy_image DEBUG:lib.cuckoo.core.plugins: |-- deletes_self 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- deletes_self DEBUG:lib.cuckoo.core.plugins: |-- deletes_shadow_copies 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- deletes_shadow_copies DEBUG:lib.cuckoo.core.plugins: |-- deletes_system_state_backup 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- deletes_system_state_backup DEBUG:lib.cuckoo.core.plugins: |-- dep_bypass 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dep_bypass DEBUG:lib.cuckoo.core.plugins: |-- dep_disable 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dep_disable DEBUG:lib.cuckoo.core.plugins: |-- disables_mappeddrives_autodisconnect 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- disables_mappeddrives_autodisconnect DEBUG:lib.cuckoo.core.plugins: |-- disables_spdy 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- disables_spdy DEBUG:lib.cuckoo.core.plugins: |-- disables_wfp 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- disables_wfp DEBUG:lib.cuckoo.core.plugins: |-- dll_load_uncommon_file_types 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dll_load_uncommon_file_types DEBUG:lib.cuckoo.core.plugins: |-- document_script_exe_drop 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- document_script_exe_drop DEBUG:lib.cuckoo.core.plugins: |-- guloader_apis 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- guloader_apis DEBUG:lib.cuckoo.core.plugins: |-- dridex_behavior 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dridex_behavior DEBUG:lib.cuckoo.core.plugins: |-- driver_load 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- driver_load DEBUG:lib.cuckoo.core.plugins: |-- exe_dropper_js 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exe_dropper_js DEBUG:lib.cuckoo.core.plugins: |-- dynamic_function_loading 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dynamic_function_loading DEBUG:lib.cuckoo.core.plugins: |-- angler_js 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- angler_js DEBUG:lib.cuckoo.core.plugins: |-- gondad_js 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- gondad_js DEBUG:lib.cuckoo.core.plugins: |-- heapspray_js 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- heapspray_js DEBUG:lib.cuckoo.core.plugins: |-- java_js 2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- java_js DEBUG:lib.cuckoo.core.plugins: |-- neutrino_js 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- neutrino_js DEBUG:lib.cuckoo.core.plugins: |-- nuclear_js 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nuclear_js DEBUG:lib.cuckoo.core.plugins: |-- rig_js 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- rig_js DEBUG:lib.cuckoo.core.plugins: |-- silverlight_js 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- silverlight_js DEBUG:lib.cuckoo.core.plugins: |-- sundown_js 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- sundown_js DEBUG:lib.cuckoo.core.plugins: |-- virtualcheck_js 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- virtualcheck_js DEBUG:lib.cuckoo.core.plugins: |-- encrypted_ioc 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypted_ioc DEBUG:lib.cuckoo.core.plugins: |-- exec_crash 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exec_crash DEBUG:lib.cuckoo.core.plugins: |-- process_creation_suspicious_location 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- process_creation_suspicious_location DEBUG:lib.cuckoo.core.plugins: |-- exploit_getbasekerneladdress 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exploit_getbasekerneladdress DEBUG:lib.cuckoo.core.plugins: |-- exploit_gethaldispatchtable 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exploit_gethaldispatchtable DEBUG:lib.cuckoo.core.plugins: |-- exploit_heapspray 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exploit_heapspray DEBUG:lib.cuckoo.core.plugins: |-- koadic_apis 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- koadic_apis DEBUG:lib.cuckoo.core.plugins: |-- koadic_network_activity 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- koadic_network_activity DEBUG:lib.cuckoo.core.plugins: |-- downloads_from_filehosting 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- downloads_from_filehosting DEBUG:lib.cuckoo.core.plugins: |-- generic_phish 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- generic_phish DEBUG:lib.cuckoo.core.plugins: |-- gootkit_behavior 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- gootkit_behavior DEBUG:lib.cuckoo.core.plugins: |-- h1n1_behavior 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- h1n1_behavior DEBUG:lib.cuckoo.core.plugins: |-- hancitor_behavior 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- hancitor_behavior DEBUG:lib.cuckoo.core.plugins: |-- hawkeye_behavior 2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- hawkeye_behavior DEBUG:lib.cuckoo.core.plugins: |-- http_request 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- http_request DEBUG:lib.cuckoo.core.plugins: |-- https_urls 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- https_urls DEBUG:lib.cuckoo.core.plugins: |-- infostealer_browser 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- infostealer_browser DEBUG:lib.cuckoo.core.plugins: |-- infostealer_browser_password 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- infostealer_browser_password DEBUG:lib.cuckoo.core.plugins: |-- cryptbot_network 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cryptbot_network DEBUG:lib.cuckoo.core.plugins: |-- infostealer_keylog 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- infostealer_keylog DEBUG:lib.cuckoo.core.plugins: |-- masslogger_artifacts 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- masslogger_artifacts DEBUG:lib.cuckoo.core.plugins: |-- masslogger_version 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- masslogger_version DEBUG:lib.cuckoo.core.plugins: |-- purplewave_network_activity 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- purplewave_network_activity DEBUG:lib.cuckoo.core.plugins: |-- quilclipper_behavior 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- quilclipper_behavior DEBUG:lib.cuckoo.core.plugins: |-- raccoon_behavior 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- raccoon_behavior DEBUG:lib.cuckoo.core.plugins: |-- captures_screenshot 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- captures_screenshot DEBUG:lib.cuckoo.core.plugins: |-- vidar_behavior 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- vidar_behavior DEBUG:lib.cuckoo.core.plugins: |-- injection_createremotethread 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_createremotethread DEBUG:lib.cuckoo.core.plugins: |-- injection_explorer 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_explorer DEBUG:lib.cuckoo.core.plugins: |-- injection_needextension 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_needextension DEBUG:lib.cuckoo.core.plugins: |-- injection_network_traffic 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_network_traffic DEBUG:lib.cuckoo.core.plugins: |-- injection_runpe 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_runpe DEBUG:lib.cuckoo.core.plugins: |-- injection_rwx 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_rwx DEBUG:lib.cuckoo.core.plugins: |-- injection_themeinitapihook 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_themeinitapihook DEBUG:lib.cuckoo.core.plugins: |-- internet_dropper 2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- internet_dropper DEBUG:lib.cuckoo.core.plugins: |-- ipc_namedpipe 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ipc_namedpipe DEBUG:lib.cuckoo.core.plugins: |-- js_phish 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- js_phish DEBUG:lib.cuckoo.core.plugins: |-- js_suspicious_redirect 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- js_suspicious_redirect DEBUG:lib.cuckoo.core.plugins: |-- kazybot_behavior 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kazybot_behavior DEBUG:lib.cuckoo.core.plugins: |-- kelihos_behavior 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kelihos_behavior DEBUG:lib.cuckoo.core.plugins: |-- kibex_behavior 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kibex_behavior DEBUG:lib.cuckoo.core.plugins: |-- kovter_behavior 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kovter_behavior DEBUG:lib.cuckoo.core.plugins: |-- locky_behavior 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- locky_behavior DEBUG:lib.cuckoo.core.plugins: |-- malicious_dynamic_function_loading 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- malicious_dynamic_function_loading DEBUG:lib.cuckoo.core.plugins: |-- encrypt_pcinfo 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_pcinfo DEBUG:lib.cuckoo.core.plugins: |-- encrypt_data_agenttesla_http 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_data_agenttesla_http DEBUG:lib.cuckoo.core.plugins: |-- encrypt_data_agentteslat2_http 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_data_agentteslat2_http DEBUG:lib.cuckoo.core.plugins: |-- encrypt_data_nanocore 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_data_nanocore DEBUG:lib.cuckoo.core.plugins: |-- mimics_agent 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- mimics_agent DEBUG:lib.cuckoo.core.plugins: |-- mimics_filetime 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- mimics_filetime DEBUG:lib.cuckoo.core.plugins: |-- quilclipper_behavior 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- quilclipper_behavior DEBUG:lib.cuckoo.core.plugins: |-- modify_desktop_wallpaper 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- modify_desktop_wallpaper DEBUG:lib.cuckoo.core.plugins: |-- modify_zoneid_ads 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- modify_zoneid_ads DEBUG:lib.cuckoo.core.plugins: |-- move_file_on_reboot 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- move_file_on_reboot DEBUG:lib.cuckoo.core.plugins: |-- multiple_useragents 2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- multiple_useragents DEBUG:lib.cuckoo.core.plugins: |-- network_anomaly 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_anomaly DEBUG:lib.cuckoo.core.plugins: |-- network_bind 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_bind DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_archive 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_archive DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_free_webshoting 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_free_webshoting DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_generic 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_generic DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_temp_urldns 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_temp_urldns DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_pastesite 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_pastesite DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_payload 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_payload DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_socialmedia 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_socialmedia DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_telegram 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_telegram DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_tempstorage 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_tempstorage DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_temp_urldns 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_temp_urldns DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_urlshortener 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_urlshortener DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_useragent 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_useragent DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_smtps_exfil 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_smtps_exfil DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_smtps_generic 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_smtps_generic DEBUG:lib.cuckoo.core.plugins: |-- network_dns_idn 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_dns_idn DEBUG:lib.cuckoo.core.plugins: |-- network_dns_suspicious_querytype 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_dns_suspicious_querytype DEBUG:lib.cuckoo.core.plugins: |-- network_dns_tunneling_request 2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_dns_tunneling_request DEBUG:lib.cuckoo.core.plugins: |-- network_document_http 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_document_http DEBUG:lib.cuckoo.core.plugins: |-- explorer_http 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- explorer_http DEBUG:lib.cuckoo.core.plugins: |-- network_fake_useragent 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_fake_useragent DEBUG:lib.cuckoo.core.plugins: |-- network_document_file 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_document_file DEBUG:lib.cuckoo.core.plugins: |-- network_downloader_exe 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_downloader_exe DEBUG:lib.cuckoo.core.plugins: |-- network_tor 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_tor DEBUG:lib.cuckoo.core.plugins: |-- nymaim_behavior 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nymaim_behavior DEBUG:lib.cuckoo.core.plugins: |-- office_com_load 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_com_load DEBUG:lib.cuckoo.core.plugins: |-- office_dotnet_load 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_dotnet_load DEBUG:lib.cuckoo.core.plugins: |-- office_mshtml_load 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_mshtml_load DEBUG:lib.cuckoo.core.plugins: |-- office_vb_load 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_vb_load DEBUG:lib.cuckoo.core.plugins: |-- office_wmi_load 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_wmi_load DEBUG:lib.cuckoo.core.plugins: |-- office_cve2017_11882 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve2017_11882 DEBUG:lib.cuckoo.core.plugins: |-- office_cve2017_11882_network 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve2017_11882_network DEBUG:lib.cuckoo.core.plugins: |-- office_cve_2021_40444 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve_2021_40444 DEBUG:lib.cuckoo.core.plugins: |-- office_cve_2021_40444_m2 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve_2021_40444_m2 DEBUG:lib.cuckoo.core.plugins: |-- office_flash_load 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_flash_load DEBUG:lib.cuckoo.core.plugins: |-- office_postscript 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_postscript DEBUG:lib.cuckoo.core.plugins: |-- office_suspicious_processes 2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_suspicious_processes DEBUG:lib.cuckoo.core.plugins: |-- office_write_exe 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_write_exe DEBUG:lib.cuckoo.core.plugins: |-- packer_themida 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- packer_themida DEBUG:lib.cuckoo.core.plugins: |-- persistence_autorun 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_autorun DEBUG:lib.cuckoo.core.plugins: |-- persistence_autorun_tasks 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_autorun_tasks DEBUG:lib.cuckoo.core.plugins: |-- persistence_bootexecute 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_bootexecute DEBUG:lib.cuckoo.core.plugins: |-- persistence_registry_script 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_registry_script DEBUG:lib.cuckoo.core.plugins: |-- pony_behavior 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- pony_behavior DEBUG:lib.cuckoo.core.plugins: |-- powershell_network_connection 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- powershell_network_connection DEBUG:lib.cuckoo.core.plugins: |-- powershell_download 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- powershell_download DEBUG:lib.cuckoo.core.plugins: |-- powershell_request 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- powershell_request DEBUG:lib.cuckoo.core.plugins: |-- createtoolhelp32snapshot_module_enumeration 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- createtoolhelp32snapshot_module_enumeration DEBUG:lib.cuckoo.core.plugins: |-- enumerates_running_processes 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- enumerates_running_processes DEBUG:lib.cuckoo.core.plugins: |-- process_interest 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- process_interest DEBUG:lib.cuckoo.core.plugins: |-- process_needed 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- process_needed DEBUG:lib.cuckoo.core.plugins: |-- mass_data_encryption 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- mass_data_encryption DEBUG:lib.cuckoo.core.plugins: |-- ransomware_dmalocker 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ransomware_dmalocker DEBUG:lib.cuckoo.core.plugins: |-- ransomware_file_modifications 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ransomware_file_modifications DEBUG:lib.cuckoo.core.plugins: |-- ransomware_message 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ransomware_message DEBUG:lib.cuckoo.core.plugins: |-- nemty_network_activity 2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nemty_network_activity DEBUG:lib.cuckoo.core.plugins: |-- nemty_note 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nemty_note DEBUG:lib.cuckoo.core.plugins: |-- sodinokibi_behavior 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- sodinokibi_behavior DEBUG:lib.cuckoo.core.plugins: |-- stop_ransomware_registry 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stop_ransomware_registry DEBUG:lib.cuckoo.core.plugins: |-- blackrat_apis 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- blackrat_apis DEBUG:lib.cuckoo.core.plugins: |-- blackrat_network_activity 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- blackrat_network_activity DEBUG:lib.cuckoo.core.plugins: |-- blackrat_registry_keys 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- blackrat_registry_keys DEBUG:lib.cuckoo.core.plugins: |-- dcrat_behavior 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dcrat_behavior DEBUG:lib.cuckoo.core.plugins: |-- karagany_system_event_objects 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- karagany_system_event_objects DEBUG:lib.cuckoo.core.plugins: |-- rat_luminosity 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- rat_luminosity DEBUG:lib.cuckoo.core.plugins: |-- rat_nanocore 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- rat_nanocore DEBUG:lib.cuckoo.core.plugins: |-- netwire_behavior 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- netwire_behavior DEBUG:lib.cuckoo.core.plugins: |-- obliquerat_network_activity 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- obliquerat_network_activity DEBUG:lib.cuckoo.core.plugins: |-- orcusrat_behavior 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- orcusrat_behavior DEBUG:lib.cuckoo.core.plugins: |-- trochilusrat_apis 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- trochilusrat_apis DEBUG:lib.cuckoo.core.plugins: |-- reads_self 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- reads_self DEBUG:lib.cuckoo.core.plugins: |-- recon_beacon 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- recon_beacon DEBUG:lib.cuckoo.core.plugins: |-- recon_programs 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- recon_programs DEBUG:lib.cuckoo.core.plugins: |-- recon_systeminfo 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- recon_systeminfo DEBUG:lib.cuckoo.core.plugins: |-- accesses_recyclebin 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- accesses_recyclebin DEBUG:lib.cuckoo.core.plugins: |-- removes_zoneid_ads 2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- removes_zoneid_ads DEBUG:lib.cuckoo.core.plugins: |-- script_created_process 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- script_created_process DEBUG:lib.cuckoo.core.plugins: |-- script_network_activity 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- script_network_activity DEBUG:lib.cuckoo.core.plugins: |-- suspicious_js_script 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- suspicious_js_script DEBUG:lib.cuckoo.core.plugins: |-- secure_login_phishing 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- secure_login_phishing DEBUG:lib.cuckoo.core.plugins: |-- securityxploded_modules 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- securityxploded_modules DEBUG:lib.cuckoo.core.plugins: |-- get_clipboard_data 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- get_clipboard_data DEBUG:lib.cuckoo.core.plugins: |-- sets_autoconfig_url 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- sets_autoconfig_url DEBUG:lib.cuckoo.core.plugins: |-- shifu_behavior 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- shifu_behavior DEBUG:lib.cuckoo.core.plugins: |-- spoofs_procname 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- spoofs_procname DEBUG:lib.cuckoo.core.plugins: |-- stack_pivot 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stack_pivot DEBUG:lib.cuckoo.core.plugins: |-- stack_pivot_file_created 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stack_pivot_file_created DEBUG:lib.cuckoo.core.plugins: |-- stack_pivot_process_create 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stack_pivot_process_create DEBUG:lib.cuckoo.core.plugins: |-- set_clipboard_data 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- set_clipboard_data DEBUG:lib.cuckoo.core.plugins: |-- stealth_childproc 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_childproc DEBUG:lib.cuckoo.core.plugins: |-- stealth_file 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_file DEBUG:lib.cuckoo.core.plugins: |-- stealth_network 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_network DEBUG:lib.cuckoo.core.plugins: |-- stealth_system_procname 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_system_procname DEBUG:lib.cuckoo.core.plugins: |-- stealth_timeout 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_timeout DEBUG:lib.cuckoo.core.plugins: |-- stealth_window 2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_window DEBUG:lib.cuckoo.core.plugins: |-- terminates_remote_process 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- terminates_remote_process DEBUG:lib.cuckoo.core.plugins: |-- tinba_behavior 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- tinba_behavior DEBUG:lib.cuckoo.core.plugins: |-- trickbot_task_delete 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- trickbot_task_delete DEBUG:lib.cuckoo.core.plugins: |-- upatre_behavior 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- upatre_behavior DEBUG:lib.cuckoo.core.plugins: |-- ursnif_behavior 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ursnif_behavior DEBUG:lib.cuckoo.core.plugins: |-- user_enum 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- user_enum DEBUG:lib.cuckoo.core.plugins: |-- vawtrak_behavior 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- vawtrak_behavior DEBUG:lib.cuckoo.core.plugins: |-- vawtrak_behavior 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- vawtrak_behavior DEBUG:lib.cuckoo.core.plugins: |-- virus 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- virus DEBUG:lib.cuckoo.core.plugins: |-- neshta_files 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- neshta_files DEBUG:lib.cuckoo.core.plugins: |-- neshta_regkeys 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- neshta_regkeys DEBUG:lib.cuckoo.core.plugins: |-- webmail_phish 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- webmail_phish DEBUG:lib.cuckoo.core.plugins: |-- persists_dev_util 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persists_dev_util DEBUG:lib.cuckoo.core.plugins: |-- spawns_dev_util 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- spawns_dev_util DEBUG:lib.cuckoo.core.plugins: |-- alters_windows_utility 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- alters_windows_utility DEBUG:lib.cuckoo.core.plugins: |-- overwrites_accessibility_utility 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- overwrites_accessibility_utility DEBUG:lib.cuckoo.core.plugins: |-- wiper_zeroedbytes 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- wiper_zeroedbytes DEBUG:lib.cuckoo.core.plugins: |-- wmi_create_process 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- wmi_create_process DEBUG:lib.cuckoo.core.plugins: |-- wmi_script_process 2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- wmi_script_process DEBUG:lib.cuckoo.core.plugins: -- win32_process_create 2022-09-15 15:12:47,260 [Task 28] [lib.cuckoo.core.plugins] DEBUG:-- win32_process_create DEBUG:lib.cuckoo.core.plugins:Running non-evented signatures 2022-09-15 15:12:49,778 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running non-evented signatures DEBUG:lib.cuckoo.core.plugins:Running signature "cape_detected_threat" 2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_detected_threat" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "cape_detected_threat" 2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "cape_detected_threat" DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_mailslot" 2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_mailslot" DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_netlogon_regkey" 2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_netlogon_regkey" DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_sysvol" 2022-09-15 15:12:49,780 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_sysvol" DEBUG:lib.cuckoo.core.plugins:Running signature "writes_sysvol" 2022-09-15 15:12:49,781 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "writes_sysvol" DEBUG:lib.cuckoo.core.plugins:Running signature "adds_admin_user" 2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "adds_admin_user" DEBUG:lib.cuckoo.core.plugins:Running signature "adds_user" 2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "adds_user" DEBUG:lib.cuckoo.core.plugins:Running signature "overwrites_admin_password" 2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "overwrites_admin_password" DEBUG:lib.cuckoo.core.plugins:Running signature "antianalysis_detectfile" 2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antianalysis_detectfile" DEBUG:lib.cuckoo.core.plugins:Running signature "antianalysis_detectreg" 2022-09-15 15:12:49,792 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antianalysis_detectreg" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_attachment_manager" 2022-09-15 15:12:49,972 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_attachment_manager" DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_detectfile" 2022-09-15 15:12:49,972 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_detectfile" DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_detectreg" 2022-09-15 15:12:49,998 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_detectreg" DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_srp" 2022-09-15 15:12:50,822 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_srp" DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_whitespace" 2022-09-15 15:12:50,822 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_whitespace" DEBUG:lib.cuckoo.core.plugins:Running signature "antidebug_devices" 2022-09-15 15:12:50,823 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antidebug_devices" DEBUG:lib.cuckoo.core.plugins:Running signature "antiemu_windefend" 2022-09-15 15:12:50,826 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiemu_windefend" DEBUG:lib.cuckoo.core.plugins:Running signature "antiemu_wine_reg" 2022-09-15 15:12:50,827 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiemu_wine_reg" DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_cuckoo_files" 2022-09-15 15:12:50,828 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_cuckoo_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_fortinet_files" 2022-09-15 15:12:50,828 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_fortinet_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_joe_anubis_files" 2022-09-15 15:12:50,829 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_joe_anubis_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_sboxie_mutex" 2022-09-15 15:12:50,830 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_sboxie_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_sunbelt_files" 2022-09-15 15:12:50,830 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_sunbelt_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_threattrack_files" 2022-09-15 15:12:50,831 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_threattrack_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antivirus_clamav" 2022-09-15 15:12:50,831 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivirus_clamav" DEBUG:lib.cuckoo.core.plugins:Running signature "antivirus_virustotal" 2022-09-15 15:12:50,832 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivirus_virustotal" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_bochs_keys" 2022-09-15 15:12:50,832 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_bochs_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_bios" 2022-09-15 15:12:50,847 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_bios" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_cpu" 2022-09-15 15:12:50,862 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_cpu" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_diskreg" 2022-09-15 15:12:50,863 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_diskreg" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_system" 2022-09-15 15:12:50,899 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_system" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_hyperv_keys" 2022-09-15 15:12:50,909 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_hyperv_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_parallels_keys" 2022-09-15 15:12:50,929 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_parallels_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vbox_devices" 2022-09-15 15:12:50,979 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vbox_devices" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vbox_files" 2022-09-15 15:12:50,981 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vbox_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vbox_keys" 2022-09-15 15:12:50,992 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vbox_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_devices" 2022-09-15 15:12:51,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_devices" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_files" 2022-09-15 15:12:51,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_keys" 2022-09-15 15:12:51,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_mutexes" 2022-09-15 15:12:51,154 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vpc_files" 2022-09-15 15:12:51,154 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vpc_files" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vpc_keys" 2022-09-15 15:12:51,155 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vpc_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vpc_mutex" 2022-09-15 15:12:51,186 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vpc_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_xen_keys" 2022-09-15 15:12:51,187 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_xen_keys" DEBUG:lib.cuckoo.core.plugins:Running signature "gulpix_behavior" 2022-09-15 15:12:51,235 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "gulpix_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "ketrican_regkeys" 2022-09-15 15:12:51,236 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ketrican_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "okrum_mutexes" 2022-09-15 15:12:51,239 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "okrum_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "bad_certs" 2022-09-15 15:12:51,239 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bad_certs" DEBUG:lib.cuckoo.core.plugins:Running signature "bad_ssl_certs" 2022-09-15 15:12:51,239 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bad_ssl_certs" DEBUG:lib.cuckoo.core.plugins:Running signature "banker_cridex" 2022-09-15 15:12:51,240 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_cridex" DEBUG:lib.cuckoo.core.plugins:Running signature "geodo_banking_trojan" 2022-09-15 15:12:51,241 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "geodo_banking_trojan" DEBUG:lib.cuckoo.core.plugins:Running signature "banker_spyeye_mutexes" 2022-09-15 15:12:51,263 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_spyeye_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "banker_zeus_mutex" 2022-09-15 15:12:51,263 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_zeus_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "banker_zeus_p2p" 2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_zeus_p2p" DEBUG:lib.cuckoo.core.plugins:Running signature "banker_zeus_url" 2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_zeus_url" DEBUG:lib.cuckoo.core.plugins:Running signature "bitcoin_opencl" 2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bitcoin_opencl" DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_primary_patition" 2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_primary_patition" DEBUG:lib.cuckoo.core.plugins:Running signature "direct_hdd_access" 2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "direct_hdd_access" DEBUG:lib.cuckoo.core.plugins:Running signature "physical_drive_access" 2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "physical_drive_access" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_athenahttp" 2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_athenahttp" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_dirtjumper" 2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_dirtjumper" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_drive" 2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_drive" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_drive2" 2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_drive2" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_madness" 2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_madness" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_russkill" 2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_russkill" DEBUG:lib.cuckoo.core.plugins:Running signature "browser_addon" 2022-09-15 15:12:51,267 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_addon" DEBUG:lib.cuckoo.core.plugins:Running signature "browser_helper_object" 2022-09-15 15:12:51,269 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_helper_object" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_proxy" 2022-09-15 15:12:51,269 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_proxy" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "modify_proxy" 2022-09-15 15:12:51,270 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "modify_proxy" DEBUG:lib.cuckoo.core.plugins:Running signature "browser_security" 2022-09-15 15:12:51,270 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_security" DEBUG:lib.cuckoo.core.plugins:Running signature "browser_startpage" 2022-09-15 15:12:51,276 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_startpage" DEBUG:lib.cuckoo.core.plugins:Running signature "ie_disables_process_tab" 2022-09-15 15:12:51,277 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ie_disables_process_tab" DEBUG:lib.cuckoo.core.plugins:Running signature "odbcconf_bypass" 2022-09-15 15:12:51,277 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "odbcconf_bypass" DEBUG:lib.cuckoo.core.plugins:Running signature "squiblydoo_bypass" 2022-09-15 15:12:51,278 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "squiblydoo_bypass" DEBUG:lib.cuckoo.core.plugins:Running signature "squiblytwo_bypass" 2022-09-15 15:12:51,278 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "squiblytwo_bypass" DEBUG:lib.cuckoo.core.plugins:Running signature "bypass_firewall" 2022-09-15 15:12:51,278 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bypass_firewall" DEBUG:lib.cuckoo.core.plugins:Running signature "uac_bypass_cmstpcom" 2022-09-15 15:12:51,293 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uac_bypass_cmstpcom" DEBUG:lib.cuckoo.core.plugins:Running signature "uac_bypass_delegateexecute_sdclt" 2022-09-15 15:12:51,293 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uac_bypass_delegateexecute_sdclt" DEBUG:lib.cuckoo.core.plugins:Running signature "uac_bypass_fodhelper" 2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uac_bypass_fodhelper" DEBUG:lib.cuckoo.core.plugins:Running signature "cape_extracted_content" 2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_extracted_content" DEBUG:lib.cuckoo.core.plugins:Running signature "cape_extracted_config" 2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_extracted_config" DEBUG:lib.cuckoo.core.plugins:Running signature "cape_extracted_content" 2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_extracted_content" DEBUG:lib.cuckoo.core.plugins:Running signature "carberp_mutex" 2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "carberp_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "clears_logs" 2022-09-15 15:12:51,295 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "clears_logs" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_obfuscation" 2022-09-15 15:12:51,295 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_obfuscation" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_switches" 2022-09-15 15:12:51,295 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_switches" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_terminate" 2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_terminate" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_forfiles_wildcard" 2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_forfiles_wildcard" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_http_link" 2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_http_link" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_long_string" 2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_long_string" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_reversed_http_link" 2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_reversed_http_link" DEBUG:lib.cuckoo.core.plugins:Running signature "long_commandline" 2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "long_commandline" DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_renamed_commandline" 2022-09-15 15:12:51,297 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_renamed_commandline" DEBUG:lib.cuckoo.core.plugins:Running signature "codelux_behavior" 2022-09-15 15:12:51,297 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "codelux_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "system_account_discovery_cmd" 2022-09-15 15:12:51,298 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_account_discovery_cmd" DEBUG:lib.cuckoo.core.plugins:Running signature "system_info_discovery_cmd" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_info_discovery_cmd" DEBUG:lib.cuckoo.core.plugins:Running signature "system_info_discovery_pwsh" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_info_discovery_pwsh" DEBUG:lib.cuckoo.core.plugins:Running signature "system_network_discovery_cmd" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_network_discovery_cmd" DEBUG:lib.cuckoo.core.plugins:Running signature "system_network_discovery_pwsh" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_network_discovery_pwsh" DEBUG:lib.cuckoo.core.plugins:Running signature "system_user_discovery_cmd" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_user_discovery_cmd" DEBUG:lib.cuckoo.core.plugins:Running signature "copies_self" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "copies_self" DEBUG:lib.cuckoo.core.plugins:Running signature "enables_wdigest" 2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "enables_wdigest" DEBUG:lib.cuckoo.core.plugins:Running signature "file_credential_store_access" 2022-09-15 15:12:51,300 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "file_credential_store_access" DEBUG:lib.cuckoo.core.plugins:Running signature "file_credential_store_write" 2022-09-15 15:12:51,301 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "file_credential_store_write" DEBUG:lib.cuckoo.core.plugins:Running signature "registry_credential_dumping" 2022-09-15 15:12:51,301 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "registry_credential_dumping" DEBUG:lib.cuckoo.core.plugins:Running signature "registry_credential_store_access" 2022-09-15 15:12:51,301 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "registry_credential_store_access" DEBUG:lib.cuckoo.core.plugins:Running signature "registry_lsa_secrets_access" 2022-09-15 15:12:51,303 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "registry_lsa_secrets_access" DEBUG:lib.cuckoo.core.plugins:Running signature "cryptomining_stratum_command" 2022-09-15 15:12:51,304 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptomining_stratum_command" DEBUG:lib.cuckoo.core.plugins:Running signature "cryptopool_domains" 2022-09-15 15:12:51,304 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptopool_domains" DEBUG:lib.cuckoo.core.plugins:Running signature "cypherit_mutexes" 2022-09-15 15:12:51,305 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cypherit_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "darkcomet_regkeys" 2022-09-15 15:12:51,305 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "darkcomet_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "datop_loader" 2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "datop_loader" DEBUG:lib.cuckoo.core.plugins:Running signature "deepfreeze_mutex" 2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "deepfreeze_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "deletes_executed_files" 2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "deletes_executed_files" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_app_launch" 2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_app_launch" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_auto_app_termination" 2022-09-15 15:12:51,312 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_auto_app_termination" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_appv_virtualization" 2022-09-15 15:12:51,312 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_appv_virtualization" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_backups" 2022-09-15 15:12:51,313 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_backups" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_browser_warn" 2022-09-15 15:12:51,314 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_browser_warn" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_context_menus" 2022-09-15 15:12:51,319 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_context_menus" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_cpl_disable" 2022-09-15 15:12:51,320 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_cpl_disable" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_event_logging" 2022-09-15 15:12:51,320 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_event_logging" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_folder_options" 2022-09-15 15:12:51,321 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_folder_options" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_notificationcenter" 2022-09-15 15:12:51,321 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_notificationcenter" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_power_options" 2022-09-15 15:12:51,322 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_power_options" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_restore_default_state" 2022-09-15 15:12:51,323 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_restore_default_state" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_run_command" 2022-09-15 15:12:51,323 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_run_command" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_security" 2022-09-15 15:12:51,323 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_security" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_smartscreen" 2022-09-15 15:12:51,324 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_smartscreen" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_startmenu_search" 2022-09-15 15:12:51,324 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_startmenu_search" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_system_restore" 2022-09-15 15:12:51,325 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_system_restore" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_uac" 2022-09-15 15:12:51,326 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_uac" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_wer" 2022-09-15 15:12:51,327 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_wer" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windows_defender" 2022-09-15 15:12:51,328 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windows_defender" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windows_defender_logging" 2022-09-15 15:12:51,330 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windows_defender_logging" DEBUG:lib.cuckoo.core.plugins:Running signature "removes_windows_defender_contextmenu" 2022-09-15 15:12:51,331 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_windows_defender_contextmenu" DEBUG:lib.cuckoo.core.plugins:Running signature "windows_defender_powershell" 2022-09-15 15:12:51,331 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "windows_defender_powershell" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windows_file_protection" 2022-09-15 15:12:51,332 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windows_file_protection" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windowsupdate" 2022-09-15 15:12:51,332 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windowsupdate" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_winfirewall" 2022-09-15 15:12:51,333 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_winfirewall" DEBUG:lib.cuckoo.core.plugins:Running signature "andromut_mutexes" 2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "andromut_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "downloader_cabby" 2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "downloader_cabby" DEBUG:lib.cuckoo.core.plugins:Running signature "phorpiex_mutexes" 2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "phorpiex_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "protonbot_mutexes" 2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "protonbot_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "driver_filtermanager" 2022-09-15 15:12:51,335 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "driver_filtermanager" DEBUG:lib.cuckoo.core.plugins:Running signature "dropper" 2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dropper" DEBUG:lib.cuckoo.core.plugins:Running signature "excel4_macro_urls" 2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "excel4_macro_urls" DEBUG:lib.cuckoo.core.plugins:Running signature "spooler_access" 2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spooler_access" DEBUG:lib.cuckoo.core.plugins:Running signature "spooler_svc_start" 2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spooler_svc_start" DEBUG:lib.cuckoo.core.plugins:Running signature "family_proxyback" 2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "family_proxyback" DEBUG:lib.cuckoo.core.plugins:Running signature "mapped_drives_uac" 2022-09-15 15:12:51,337 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mapped_drives_uac" DEBUG:lib.cuckoo.core.plugins:Running signature "hides_recycle_bin_icon" 2022-09-15 15:12:51,337 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "hides_recycle_bin_icon" DEBUG:lib.cuckoo.core.plugins:Running signature "apocalypse_stealer_file_behavior" 2022-09-15 15:12:51,337 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "apocalypse_stealer_file_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "arkei_files" 2022-09-15 15:12:51,339 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "arkei_files" DEBUG:lib.cuckoo.core.plugins:Running signature "azorult_mutexes" 2022-09-15 15:12:51,339 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "azorult_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_bitcoin" 2022-09-15 15:12:51,340 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_bitcoin" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "infostealer_bitcoin" 2022-09-15 15:12:51,353 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "infostealer_bitcoin" DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_cookies" 2022-09-15 15:12:51,353 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_cookies" DEBUG:lib.cuckoo.core.plugins:Running signature "cryptbot_files" 2022-09-15 15:12:51,358 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptbot_files" DEBUG:lib.cuckoo.core.plugins:Running signature "echelon_files" 2022-09-15 15:12:51,361 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "echelon_files" DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_ftp" 2022-09-15 15:12:51,362 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_ftp" DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_im" 2022-09-15 15:12:51,642 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_im" DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_mail" 2022-09-15 15:12:51,835 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_mail" DEBUG:lib.cuckoo.core.plugins:Running signature "masslogger_files" 2022-09-15 15:12:51,881 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "masslogger_files" DEBUG:lib.cuckoo.core.plugins:Running signature "poullight_files" 2022-09-15 15:12:51,882 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "poullight_files" DEBUG:lib.cuckoo.core.plugins:Running signature "purplewave_mutexes" 2022-09-15 15:12:51,888 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "purplewave_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "quilclipper_mutexes" 2022-09-15 15:12:51,889 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "quilclipper_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "qulab_files" 2022-09-15 15:12:51,889 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "qulab_files" DEBUG:lib.cuckoo.core.plugins:Running signature "qulab_mutexes" 2022-09-15 15:12:51,911 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "qulab_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "bot_kraken_mutexes" 2022-09-15 15:12:51,911 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_kraken_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "locker_regedit" 2022-09-15 15:12:51,912 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "locker_regedit" DEBUG:lib.cuckoo.core.plugins:Running signature "locker_taskmgr" 2022-09-15 15:12:51,913 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "locker_taskmgr" DEBUG:lib.cuckoo.core.plugins:Running signature "ie_martian_children" 2022-09-15 15:12:51,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ie_martian_children" DEBUG:lib.cuckoo.core.plugins:Running signature "office_martian_children" 2022-09-15 15:12:51,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_martian_children" DEBUG:lib.cuckoo.core.plugins:Running signature "mimics_extension" 2022-09-15 15:12:51,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mimics_extension" DEBUG:lib.cuckoo.core.plugins:Running signature "mimics_icon" 2022-09-15 15:12:51,916 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mimics_icon" DEBUG:lib.cuckoo.core.plugins:Running signature "masquerade_process_name" 2022-09-15 15:12:51,916 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "masquerade_process_name" DEBUG:lib.cuckoo.core.plugins:Running signature "mimikatz_modules" 2022-09-15 15:12:52,022 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mimikatz_modules" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_certs" 2022-09-15 15:12:52,022 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_certs" DEBUG:lib.cuckoo.core.plugins:Running signature "dotnet_clr_usagelog_regkeys" 2022-09-15 15:12:52,023 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dotnet_clr_usagelog_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_hostfile" 2022-09-15 15:12:52,023 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_hostfile" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_oem_information" 2022-09-15 15:12:52,024 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_oem_information" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_security_center_warnings" 2022-09-15 15:12:52,024 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_security_center_warnings" DEBUG:lib.cuckoo.core.plugins:Running signature "modify_uac_prompt" 2022-09-15 15:12:52,025 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_uac_prompt" DEBUG:lib.cuckoo.core.plugins:Running signature "network_country_distribution" 2022-09-15 15:12:52,027 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_country_distribution" DEBUG:lib.cuckoo.core.plugins:Running signature "network_multiple_direct_ip_connections" 2022-09-15 15:12:52,027 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_multiple_direct_ip_connections" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_multiple_direct_ip_connections" 2022-09-15 15:12:52,033 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_multiple_direct_ip_connections" DEBUG:lib.cuckoo.core.plugins:Running signature "network_cnc_http" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_cnc_http" DEBUG:lib.cuckoo.core.plugins:Running signature "network_http_post" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_http_post" DEBUG:lib.cuckoo.core.plugins:Running signature "network_ip_exe" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_ip_exe" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dga" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dga" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dga_fraunhofer" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dga_fraunhofer" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_blockchain" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_blockchain" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_opennic" 2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_opennic" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_paste_site" 2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_paste_site" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_reverse_proxy" 2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_reverse_proxy" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_temp_file_storage" 2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_temp_file_storage" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_temp_urldns" 2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_temp_urldns" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_url_shortener" 2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_url_shortener" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_doh_tls" 2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_doh_tls" DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_tld" 2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_tld" DEBUG:lib.cuckoo.core.plugins:Running signature "network_dyndns" 2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dyndns" DEBUG:lib.cuckoo.core.plugins:Running signature "network_excessive_udp" 2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_excessive_udp" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_excessive_udp" 2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_excessive_udp" DEBUG:lib.cuckoo.core.plugins:Running signature "network_http" 2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_http" DEBUG:lib.cuckoo.core.plugins:Running signature "network_icmp" 2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_icmp" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_icmp" 2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_icmp" DEBUG:lib.cuckoo.core.plugins:Running signature "network_irc" 2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_irc" DEBUG:lib.cuckoo.core.plugins:Running signature "network_open_proxy" 2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_open_proxy" DEBUG:lib.cuckoo.core.plugins:Running signature "network_p2p" 2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_p2p" DEBUG:lib.cuckoo.core.plugins:Running signature "network_questionable_http_path" 2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_questionable_http_path" DEBUG:lib.cuckoo.core.plugins:Running signature "network_questionable_https_path" 2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_questionable_https_path" DEBUG:lib.cuckoo.core.plugins:Running signature "network_smtp" 2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_smtp" DEBUG:lib.cuckoo.core.plugins:Running signature "network_tor_service" 2022-09-15 15:12:52,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_tor_service" DEBUG:lib.cuckoo.core.plugins:Running signature "network_torgateway" 2022-09-15 15:12:52,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_torgateway" DEBUG:lib.cuckoo.core.plugins:Running signature "office_code_page" 2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_code_page" DEBUG:lib.cuckoo.core.plugins:Running signature "office_addinloading" 2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_addinloading" DEBUG:lib.cuckoo.core.plugins:Running signature "office_perfkey" 2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_perfkey" DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro" 2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro" DEBUG:lib.cuckoo.core.plugins:Running signature "changes_trust_center_settings" 2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "changes_trust_center_settings" DEBUG:lib.cuckoo.core.plugins:Running signature "disables_vba_trust_access" 2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_vba_trust_access" DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_autoexecution" 2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_autoexecution" DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_ioc" 2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_ioc" DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_malicious_prediction" 2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_malicious_prediction" DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_suspicious" 2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_suspicious" DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_aslr_bypass" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_aslr_bypass" DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_anomaly_characterset" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_anomaly_characterset" DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_anomaly_version" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_anomaly_version" DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_embedded_content" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_embedded_content" DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_embedded_office_file" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_embedded_office_file" DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_exploit_static" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_exploit_static" DEBUG:lib.cuckoo.core.plugins:Running signature "office_security" 2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_security" DEBUG:lib.cuckoo.core.plugins:Running signature "office_anomalous_feature" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_anomalous_feature" DEBUG:lib.cuckoo.core.plugins:Running signature "office_dde_command" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_dde_command" DEBUG:lib.cuckoo.core.plugins:Running signature "origin_langid" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "origin_langid" DEBUG:lib.cuckoo.core.plugins:Running signature "origin_resource_langid" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "origin_resource_langid" DEBUG:lib.cuckoo.core.plugins:Running signature "overlay" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "overlay" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_unknown_pe_section_name" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_unknown_pe_section_name" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_armadillo_mutex" 2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_armadillo_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_armadillo_regkey" 2022-09-15 15:12:52,093 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_armadillo_regkey" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_aspack" 2022-09-15 15:12:52,094 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_aspack" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_aspirecrypt" 2022-09-15 15:12:52,094 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_aspirecrypt" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_bedsprotector" 2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_bedsprotector" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_confuser" 2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_confuser" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_enigma" 2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_enigma" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_entropy" 2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_entropy" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_mpress" 2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_mpress" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_nate" 2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_nate" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_nspack" 2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_nspack" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_smartassembly" 2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_smartassembly" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_spices" 2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_spices" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_themida" 2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_themida" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_titan" 2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_titan" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_upx" 2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_upx" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_vmprotect" 2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_vmprotect" DEBUG:lib.cuckoo.core.plugins:Running signature "packer_yoda" 2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_yoda" DEBUG:lib.cuckoo.core.plugins:Running signature "pdf_annot_urls" 2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "pdf_annot_urls" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_ads" 2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_ads" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_safeboot" 2022-09-15 15:12:52,098 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_safeboot" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_ifeo" 2022-09-15 15:12:52,099 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_ifeo" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_slient_process_exit" 2022-09-15 15:12:52,100 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_slient_process_exit" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_rdp_registry" 2022-09-15 15:12:52,100 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_rdp_registry" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_rdp_shadowing" 2022-09-15 15:12:52,100 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_rdp_shadowing" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_service" 2022-09-15 15:12:52,101 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_service" DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_shim_database" 2022-09-15 15:12:52,101 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_shim_database" DEBUG:lib.cuckoo.core.plugins:Running signature "polymorphic" 2022-09-15 15:12:52,102 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "polymorphic" DEBUG:lib.cuckoo.core.plugins:Running signature "powerpool_mutexes" 2022-09-15 15:12:52,102 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powerpool_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_scriptblock_logging" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_scriptblock_logging" DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_command_suspicious" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_command_suspicious" DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_renamed" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_renamed" DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_reversed" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_reversed" DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_variable_obfuscation" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_variable_obfuscation" DEBUG:lib.cuckoo.core.plugins:Running signature "punch_plus_plus_pcres" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "punch_plus_plus_pcres" DEBUG:lib.cuckoo.core.plugins:Running signature "prevents_safeboot" 2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "prevents_safeboot" DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_process_discovery" 2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_process_discovery" DEBUG:lib.cuckoo.core.plugins:Running signature "procmem_yara" 2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "procmem_yara" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "procmem_yara" 2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "procmem_yara" DEBUG:lib.cuckoo.core.plugins:Running signature "cryptomix_mutexes" 2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptomix_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "dharma_mutexes" 2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dharma_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_extensions" 2022-09-15 15:12:52,105 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_extensions" DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_files" 2022-09-15 15:12:52,117 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_files" DEBUG:lib.cuckoo.core.plugins:Running signature "fonix_mutexes" 2022-09-15 15:12:52,141 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "fonix_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "gandcrab_mutexes" 2022-09-15 15:12:52,141 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "gandcrab_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "germanwiper_mutexes" 2022-09-15 15:12:52,142 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "germanwiper_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "medusalocker_mutexes" 2022-09-15 15:12:52,142 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "medusalocker_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "medusalocker_regkeys" 2022-09-15 15:12:52,142 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "medusalocker_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "nemty_mutexes" 2022-09-15 15:12:52,143 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "nemty_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "nemty_regkeys" 2022-09-15 15:12:52,144 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "nemty_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "pysa_mutexes" 2022-09-15 15:12:52,144 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "pysa_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_radamant" 2022-09-15 15:12:52,145 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_radamant" DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_recyclebin" 2022-09-15 15:12:52,146 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_recyclebin" DEBUG:lib.cuckoo.core.plugins:Running signature "revil_mutexes" 2022-09-15 15:12:52,146 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "revil_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_revil_regkey" 2022-09-15 15:12:52,146 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_revil_regkey" DEBUG:lib.cuckoo.core.plugins:Running signature "satan_mutexes" 2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "satan_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "snake_ransom_mutexes" 2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "snake_ransom_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "stop_ransom_mutexes" 2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stop_ransom_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "stop_ransomware_cmd" 2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stop_ransomware_cmd" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_beebus_mutexes" 2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_beebus_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "blacknet_mutexes" 2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "blacknet_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "blackrat_mutexes" 2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "blackrat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "crat_mutexes" 2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "crat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "dcrat_files" 2022-09-15 15:12:52,149 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dcrat_files" DEBUG:lib.cuckoo.core.plugins:Running signature "dcrat_mutexes" 2022-09-15 15:12:52,150 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dcrat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_fynloski_mutexes" 2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_fynloski_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "karagany_files" 2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "karagany_files" DEBUG:lib.cuckoo.core.plugins:Running signature "limerat_mutexes" 2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "limerat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "limerat_regkeys" 2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "limerat_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "lodarat_file_behavior" 2022-09-15 15:12:52,156 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "lodarat_file_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "modirat_behavior" 2022-09-15 15:12:52,156 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modirat_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "njrat_regkeys" 2022-09-15 15:12:52,157 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "njrat_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "obliquerat_files" 2022-09-15 15:12:52,158 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "obliquerat_files" DEBUG:lib.cuckoo.core.plugins:Running signature "obliquerat_mutexes" 2022-09-15 15:12:52,159 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "obliquerat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "parallax_mutexes" 2022-09-15 15:12:52,159 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "parallax_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_pcclient" 2022-09-15 15:12:52,160 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_pcclient" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_plugx_mutexes" 2022-09-15 15:12:52,161 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_plugx_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_poisonivy_mutexes" 2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_poisonivy_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_quasar_mutexes" 2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_quasar_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "ratsnif_mutexes" 2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ratsnif_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_senna_mutexes" 2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_senna_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_spynet" 2022-09-15 15:12:52,163 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_spynet" DEBUG:lib.cuckoo.core.plugins:Running signature "venomrat_mutexes" 2022-09-15 15:12:52,163 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "venomrat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "warzonerat_files" 2022-09-15 15:12:52,164 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "warzonerat_files" DEBUG:lib.cuckoo.core.plugins:Running signature "warzonerat_regkeys" 2022-09-15 15:12:52,165 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "warzonerat_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "xpertrat_files" 2022-09-15 15:12:52,168 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "xpertrat_files" DEBUG:lib.cuckoo.core.plugins:Running signature "xpertrat_mutexes" 2022-09-15 15:12:52,168 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "xpertrat_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "rat_xtreme_mutexes" 2022-09-15 15:12:52,169 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_xtreme_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "recon_checkip" 2022-09-15 15:12:52,169 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "recon_checkip" DEBUG:lib.cuckoo.core.plugins:Running signature "recon_fingerprint" 2022-09-15 15:12:52,170 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "recon_fingerprint" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "recon_fingerprint" 2022-09-15 15:12:52,172 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "recon_fingerprint" DEBUG:lib.cuckoo.core.plugins:Running signature "remcos_files" 2022-09-15 15:12:52,172 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "remcos_files" DEBUG:lib.cuckoo.core.plugins:Running signature "remcos_mutexes" 2022-09-15 15:12:52,173 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "remcos_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "remcos_regkeys" 2022-09-15 15:12:52,173 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "remcos_regkeys" DEBUG:lib.cuckoo.core.plugins:Running signature "rdptcp_key" 2022-09-15 15:12:52,175 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rdptcp_key" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_rdp_clip" 2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_rdp_clip" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_remote_desktop_session" 2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_remote_desktop_session" DEBUG:lib.cuckoo.core.plugins:Running signature "removes_networking_icon" 2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_networking_icon" DEBUG:lib.cuckoo.core.plugins:Running signature "removes_pinned_programs" 2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_pinned_programs" DEBUG:lib.cuckoo.core.plugins:Running signature "removes_security_maintenance_icon" 2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_security_maintenance_icon" DEBUG:lib.cuckoo.core.plugins:Running signature "removes_startmenu_defaults" 2022-09-15 15:12:52,177 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_startmenu_defaults" DEBUG:lib.cuckoo.core.plugins:Running signature "removes_username_startmenu" 2022-09-15 15:12:52,177 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_username_startmenu" DEBUG:lib.cuckoo.core.plugins:Running signature "spicyhotpot_behavior" 2022-09-15 15:12:52,178 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spicyhotpot_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "sniffer_winpcap" 2022-09-15 15:12:52,179 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "sniffer_winpcap" DEBUG:lib.cuckoo.core.plugins:Running signature "spreading_autoruninf" 2022-09-15 15:12:52,180 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spreading_autoruninf" DEBUG:lib.cuckoo.core.plugins:Running signature "static_authenticode" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_authenticode" DEBUG:lib.cuckoo.core.plugins:Running signature "invalid_authenticode_signature" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "invalid_authenticode_signature" DEBUG:lib.cuckoo.core.plugins:Running signature "static_dotnet_anomaly" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_dotnet_anomaly" DEBUG:lib.cuckoo.core.plugins:Running signature "static_java" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_java" DEBUG:lib.cuckoo.core.plugins:Running signature "static_pdf" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_pdf" DEBUG:lib.cuckoo.core.plugins:Running signature "static_pe_anomaly" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_pe_anomaly" DEBUG:lib.cuckoo.core.plugins:Running signature "pe_compile_timestomping" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "pe_compile_timestomping" DEBUG:lib.cuckoo.core.plugins:Running signature "static_pe_pdbpath" 2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_pe_pdbpath" DEBUG:lib.cuckoo.core.plugins:Running signature "static_rat_config" 2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_rat_config" DEBUG:lib.cuckoo.core.plugins:Running signature "static_versioninfo_anomaly" 2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_versioninfo_anomaly" DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_hidden_extension" 2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_hidden_extension" DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_hiddenreg" 2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_hiddenreg" DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_hide_notifications" 2022-09-15 15:12:52,184 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_hide_notifications" DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_webhistory" 2022-09-15 15:12:52,185 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_webhistory" DEBUG:lib.cuckoo.core.plugins:Running signature "suricata_alert" 2022-09-15 15:12:52,186 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suricata_alert" DEBUG:lib.cuckoo.core.plugins:Running signature "sysinternals_psexec" 2022-09-15 15:12:52,186 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "sysinternals_psexec" DEBUG:lib.cuckoo.core.plugins:Running signature "sysinternals_tools" 2022-09-15 15:12:52,187 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "sysinternals_tools" DEBUG:lib.cuckoo.core.plugins:Running signature "tampers_etw" 2022-09-15 15:12:52,188 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "tampers_etw" DEBUG:lib.cuckoo.core.plugins:Running signature "lsa_tampering" 2022-09-15 15:12:52,189 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "lsa_tampering" DEBUG:lib.cuckoo.core.plugins:Running signature "tampers_powershell_logging" 2022-09-15 15:12:52,189 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "tampers_powershell_logging" DEBUG:lib.cuckoo.core.plugins:Running signature "targeted_flame" 2022-09-15 15:12:52,190 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "targeted_flame" DEBUG:lib.cuckoo.core.plugins:Running signature "territorial_disputes_sigs" 2022-09-15 15:12:52,191 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "territorial_disputes_sigs" DEBUG:lib.cuckoo.core.plugins:Running signature "trickbot_mutex" 2022-09-15 15:12:52,495 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "trickbot_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "fleercivet_mutex" 2022-09-15 15:12:52,495 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "fleercivet_mutex" DEBUG:lib.cuckoo.core.plugins:Running signature "lokibot_mutexes" 2022-09-15 15:12:52,496 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "lokibot_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "ursnif_behavior" 2022-09-15 15:12:52,496 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ursnif_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "troldesh_behavior" 2022-09-15 15:12:52,497 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "troldesh_behavior" DEBUG:lib.cuckoo.core.plugins:Running signature "upatre_files" 2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "upatre_files" DEBUG:lib.cuckoo.core.plugins:Running signature "upatre_files" 2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "upatre_files" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_adfind" 2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_adfind" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_ms_protocol" 2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_ms_protocol" DEBUG:lib.cuckoo.core.plugins:Running signature "neshta_mutexes" 2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "neshta_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "renamer_mutexes" 2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "renamer_mutexes" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_devicetree_1" 2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_devicetree_1" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_handles_1" 2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_handles_1" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_ldrmodules_1" 2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_ldrmodules_1" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_ldrmodules_2" 2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_ldrmodules_2" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_malfind_1" 2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_malfind_1" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_malfind_2" 2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_malfind_2" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_modscan_1" 2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_modscan_1" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_svcscan_1" 2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_svcscan_1" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_svcscan_2" 2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_svcscan_2" DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_svcscan_3" 2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_svcscan_3" DEBUG:lib.cuckoo.core.plugins:Running signature "owa_web_shell_files" 2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "owa_web_shell_files" DEBUG:lib.cuckoo.core.plugins:Running signature "web_shell_files" 2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "web_shell_files" DEBUG:lib.cuckoo.core.plugins:Running signature "web_shell_processes" 2022-09-15 15:12:52,502 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "web_shell_processes" DEBUG:lib.cuckoo.core.plugins:Running signature "whois_create" 2022-09-15 15:12:52,502 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "whois_create" DEBUG:lib.cuckoo.core.plugins:Running signature "dotnet_csc_build" 2022-09-15 15:12:52,502 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dotnet_csc_build" DEBUG:lib.cuckoo.core.plugins:Running signature "multiple_explorer_instances" 2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "multiple_explorer_instances" DEBUG:lib.cuckoo.core.plugins:Running signature "script_tool_executed" 2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "script_tool_executed" DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_certutil_use" 2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_certutil_use" DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_command_tools" 2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_command_tools" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_command_tools" 2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_command_tools" DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_mpcmdrun_use" 2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_mpcmdrun_use" DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_ping_use" 2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_ping_use" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_ping_use" 2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_ping_use" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_powershell_copyitem" 2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_powershell_copyitem" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities" 2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "uses_windows_utilities" 2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "uses_windows_utilities" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_appcmd" 2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_appcmd" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_csvde_ldifde" 2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_csvde_ldifde" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_cipher" 2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_cipher" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_clickonce" 2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_clickonce" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_dsquery" 2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_dsquery" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_esentutl" 2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_esentutl" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_finger" 2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_finger" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_mode" 2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_mode" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_ntdsutil" 2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_ntdsutil" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_nltest" 2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_nltest" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_to_create_scheduled_task" 2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_to_create_scheduled_task" DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_xcopy" 2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_xcopy" DEBUG:lib.cuckoo.core.plugins:Running signature "wmic_command_suspicious" 2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "wmic_command_suspicious" DEBUG:lib.cuckoo.core.plugins:Running signature "scrcons_wmi_script_consumer" 2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "scrcons_wmi_script_consumer" DEBUG:lib.cuckoo.core.plugins:Running signature "allaple_mutexes" 2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "allaple_mutexes" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "cape_detected_threat" 2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "cape_detected_threat" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "antidebug_setunhandledexceptionfilter" 2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "antidebug_setunhandledexceptionfilter" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "modify_proxy" 2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "modify_proxy" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "deletes_self" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "deletes_self" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "infostealer_bitcoin" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "infostealer_bitcoin" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "injection_rwx" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "injection_rwx" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "modify_desktop_wallpaper" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "modify_desktop_wallpaper" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_multiple_direct_ip_connections" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_multiple_direct_ip_connections" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_excessive_udp" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_excessive_udp" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_icmp" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_icmp" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "procmem_yara" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "procmem_yara" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "recon_fingerprint" 2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "recon_fingerprint" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_command_tools" 2022-09-15 15:12:52,510 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_command_tools" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_ping_use" 2022-09-15 15:12:52,510 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_ping_use" DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "uses_windows_utilities" 2022-09-15 15:12:52,510 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "uses_windows_utilities" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "BinGraph" 2022-09-15 15:12:54,053 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "BinGraph" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "MITRE_TTPS" 2022-09-15 15:12:54,053 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "MITRE_TTPS" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "PCAP2CERT" 2022-09-15 15:12:54,053 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "PCAP2CERT" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "ReportHTML" 2022-09-15 15:12:54,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "ReportHTML" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "SubmitCAPE" 2022-09-15 15:12:56,039 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "SubmitCAPE" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "JsonDump" 2022-09-15 15:12:56,052 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "JsonDump" DEBUG:lib.cuckoo.core.plugins:Executing reporting module "MongoDB" 2022-09-15 15:12:56,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "MongoDB" DEBUG:modules.reporting.mongodb:Deleted previous MongoDB data for Task 28 2022-09-15 15:12:56,883 [Task 28] [modules.reporting.mongodb] DEBUG: Deleted previous MongoDB data for Task 28 DEBUG:lib.cuckoo.core.plugins:Executing reporting module "RunStatistics" 2022-09-15 15:12:57,228 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "RunStatistics" DEBUG:modules.reporting.runstatistics:Run statistics sucessed! 2022-09-15 15:12:57,251 [Task 28] [modules.reporting.runstatistics] DEBUG: Run statistics sucessed! DEBUG:root:Finished processing task 2022-09-15 15:12:57,260 [Task 28] [root] DEBUG: Finished processing task

doomedraven commented 1 year ago

i don't have time to test it right now, i will keep this open till i have some spare time but i doubt that it will be this week

doomedraven commented 1 year ago

do you have enabled memory analysis in conf/process.conf and modules inside of the conf/memory.conf. but just with having it enabled in process.conf i see memory tab

Screenshot 2022-09-15 at 10 30 43

so im not sure what is wrong on your side

doomedraven commented 1 year ago

with pslist enabled, i won't post the whole screen, but you can see that it shows me pslist correctly Screenshot 2022-09-15 at 10 33 07

helloworld104 commented 1 year ago

yes, it worked after a reboot. thanks alot

doomedraven commented 1 year ago

you don't need to reboot, you just need to restart cape-processor service when you change any processing/reporting services