Closed helloworld104 closed 1 year ago
@capeuser21: hello! :wave:
This issue is being automatically closed because it does not follow the issue template.
This is open source project! So please apreciate our time that we sacrify from other thing that we could enjoy, instead of asking boring things over and over.
Can I check how you are enabling this option?
previously my analyses did not have the "memory.dmp", so i reviewed the documentation and followed the steps to enable memory in processing.conf and memory_dump in cuckoo.conf. Now I am able to see the "memory.dmp" file in the analyses folder but I cant see any information related to the memory dump and Volatility in the webpage, which I thought should be present since there were the relevant HTML templates (example below)
So you are referring to full system dumps as opposed to full process dumps. The process memory tab in the web ui is for the latter.
Mainstream cape has never used full system dumps or vol - this was custom made by @doomedraven. I am not sure this is supported any more. Fundamentally using volatility is at odds with cape's whole raison d'être.
I have no idea. doomed is the only man who knows.
Why do you want volatility? It means cape is failing.
it should have, but do you have properly configured volatility?
kevin is not about cape failing, is about preferences of everyone, you know how long i used it ;)
The whole point of cape is so that you don't need another massive tool like vol because cape already captured everything you could want.
it should have, but do you have properly configured volatility?
i believe so, is there a way to verify whether volatility is working as expected?
I have no idea. doomed is the only man who knows.
Why do you want volatility? It means cape is failing.
i thought it would be good to be able to view the memory dump information in readable format, but I cant seem to find the memory HTML pages in the web UI
Not to mention cape's design assumes there might be interesting stuff to capture during the execution that is no longer present at the end. Cape attempts to capture payloads before execution or shortly after it begins.
yes memdumps in webpage, go yo mongo or json report and verify if you have data there + you might have something in logs about that, maybe reprocess in debug mode with process.py -r x -d
yes, my json report does have data. i have also reprocessed in debug mode and the memory module seems to run normally as shown below:
XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use MS Excel)
DEBUG:lib.cuckoo.core.plugins:Executing processing module "CAPE" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:09:44,028 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "CAPE" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:PIL.Image:Importing BmpImagePlugin
2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing BmpImagePlugin
DEBUG:PIL.Image:Importing BufrStubImagePlugin
2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing BufrStubImagePlugin
DEBUG:PIL.Image:Importing CurImagePlugin
2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing CurImagePlugin
DEBUG:PIL.Image:Importing DcxImagePlugin
2022-09-15 15:09:45,633 [Task 28] [PIL.Image] DEBUG: Importing DcxImagePlugin
DEBUG:PIL.Image:Importing DdsImagePlugin
2022-09-15 15:09:45,634 [Task 28] [PIL.Image] DEBUG: Importing DdsImagePlugin
DEBUG:PIL.Image:Importing EpsImagePlugin
2022-09-15 15:09:45,634 [Task 28] [PIL.Image] DEBUG: Importing EpsImagePlugin
DEBUG:PIL.Image:Importing FitsStubImagePlugin
2022-09-15 15:09:45,634 [Task 28] [PIL.Image] DEBUG: Importing FitsStubImagePlugin
DEBUG:PIL.Image:Importing FliImagePlugin
2022-09-15 15:09:45,635 [Task 28] [PIL.Image] DEBUG: Importing FliImagePlugin
DEBUG:PIL.Image:Importing FpxImagePlugin
2022-09-15 15:09:45,635 [Task 28] [PIL.Image] DEBUG: Importing FpxImagePlugin
DEBUG:PIL.Image:Importing FtexImagePlugin
2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing FtexImagePlugin
DEBUG:PIL.Image:Importing GbrImagePlugin
2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing GbrImagePlugin
DEBUG:PIL.Image:Importing GifImagePlugin
2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing GifImagePlugin
DEBUG:PIL.Image:Importing GribStubImagePlugin
2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing GribStubImagePlugin
DEBUG:PIL.Image:Importing Hdf5StubImagePlugin
2022-09-15 15:09:45,636 [Task 28] [PIL.Image] DEBUG: Importing Hdf5StubImagePlugin
DEBUG:PIL.Image:Importing IcnsImagePlugin
2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing IcnsImagePlugin
DEBUG:PIL.Image:Importing IcoImagePlugin
2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing IcoImagePlugin
DEBUG:PIL.Image:Importing ImImagePlugin
2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing ImImagePlugin
DEBUG:PIL.Image:Importing ImtImagePlugin
2022-09-15 15:09:45,637 [Task 28] [PIL.Image] DEBUG: Importing ImtImagePlugin
DEBUG:PIL.Image:Importing IptcImagePlugin
2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing IptcImagePlugin
DEBUG:PIL.Image:Importing JpegImagePlugin
2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing JpegImagePlugin
DEBUG:PIL.Image:Importing Jpeg2KImagePlugin
2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing Jpeg2KImagePlugin
DEBUG:PIL.Image:Importing McIdasImagePlugin
2022-09-15 15:09:45,638 [Task 28] [PIL.Image] DEBUG: Importing McIdasImagePlugin
DEBUG:PIL.Image:Importing MicImagePlugin
2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MicImagePlugin
DEBUG:PIL.Image:Importing MpegImagePlugin
2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MpegImagePlugin
DEBUG:PIL.Image:Importing MpoImagePlugin
2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MpoImagePlugin
DEBUG:PIL.Image:Importing MspImagePlugin
2022-09-15 15:09:45,639 [Task 28] [PIL.Image] DEBUG: Importing MspImagePlugin
DEBUG:PIL.Image:Importing PalmImagePlugin
2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PalmImagePlugin
DEBUG:PIL.Image:Importing PcdImagePlugin
2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PcdImagePlugin
DEBUG:PIL.Image:Importing PcxImagePlugin
2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PcxImagePlugin
DEBUG:PIL.Image:Importing PdfImagePlugin
2022-09-15 15:09:45,640 [Task 28] [PIL.Image] DEBUG: Importing PdfImagePlugin
DEBUG:PIL.Image:Importing PixarImagePlugin
2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PixarImagePlugin
DEBUG:PIL.Image:Importing PngImagePlugin
2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PngImagePlugin
DEBUG:PIL.Image:Importing PpmImagePlugin
2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PpmImagePlugin
DEBUG:PIL.Image:Importing PsdImagePlugin
2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing PsdImagePlugin
DEBUG:PIL.Image:Importing SgiImagePlugin
2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing SgiImagePlugin
DEBUG:PIL.Image:Importing SpiderImagePlugin
2022-09-15 15:09:45,641 [Task 28] [PIL.Image] DEBUG: Importing SpiderImagePlugin
DEBUG:PIL.Image:Importing SunImagePlugin
2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing SunImagePlugin
DEBUG:PIL.Image:Importing TgaImagePlugin
2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing TgaImagePlugin
DEBUG:PIL.Image:Importing TiffImagePlugin
2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing TiffImagePlugin
DEBUG:PIL.Image:Importing WebPImagePlugin
2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing WebPImagePlugin
DEBUG:PIL.Image:Image: failed to import WebPImagePlugin: cannot import name '_webp' from 'PIL' (/home/cape/.cache/pypoetry/virtualenvs/capev2-t2x27zRb-py3.8/lib/python3.8/site-packages/PIL/init.py)
2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Image: failed to import WebPImagePlugin: cannot import name '_webp' from 'PIL' (/home/cape/.cache/pypoetry/virtualenvs/capev2-t2x27zRb-py3.8/lib/python3.8/site-packages/PIL/init.py)
DEBUG:PIL.Image:Importing WmfImagePlugin
2022-09-15 15:09:45,642 [Task 28] [PIL.Image] DEBUG: Importing WmfImagePlugin
DEBUG:PIL.Image:Importing XbmImagePlugin
2022-09-15 15:09:45,643 [Task 28] [PIL.Image] DEBUG: Importing XbmImagePlugin
DEBUG:PIL.Image:Importing XpmImagePlugin
2022-09-15 15:09:45,643 [Task 28] [PIL.Image] DEBUG: Importing XpmImagePlugin
DEBUG:PIL.Image:Importing XVThumbImagePlugin
2022-09-15 15:09:45,644 [Task 28] [PIL.Image] DEBUG: Importing XVThumbImagePlugin
DEBUG:lib.cuckoo.core.plugins:Executing processing module "AnalysisInfo" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:10:14,896 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "AnalysisInfo" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "BehaviorAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:10:14,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "BehaviorAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "Curtain" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:10:16,974 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Curtain" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "Debug" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:10:16,975 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Debug" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "Dropped" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:10:16,977 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Dropped" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "Memory" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:10:39,656 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Memory" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "NetworkAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:12:32,525 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "NetworkAnalysis" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "ProcDump" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:12:32,666 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "ProcDump" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "Suricata" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:12:37,002 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "Suricata" on analysis at "/opt/CAPEv2/storage/analyses/28"
WARNING:modules.processing.suricata:Unable to Run Suricata: Conf File /etc/suricata/suricata.yaml does not exist
2022-09-15 15:12:37,002 [Task 28] [modules.processing.suricata] WARNING: Unable to Run Suricata: Conf File /etc/suricata/suricata.yaml does not exist
DEBUG:lib.cuckoo.core.plugins:Executing processing module "TargetInfo" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:12:37,003 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "TargetInfo" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "script_log_processing" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:12:37,772 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "script_log_processing" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Executing processing module "ProcessMemory" on analysis at "/opt/CAPEv2/storage/analyses/28"
2022-09-15 15:12:37,773 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing processing module "ProcessMemory" on analysis at "/opt/CAPEv2/storage/analyses/28"
DEBUG:lib.cuckoo.core.plugins:Applying signature overlays for signatures: creates_exe
2022-09-15 15:12:47,242 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Applying signature overlays for signatures: creates_exe
DEBUG:lib.cuckoo.core.plugins:Running 289 evented signatures
2022-09-15 15:12:47,244 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running 289 evented signatures
DEBUG:lib.cuckoo.core.plugins: |-- compression
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- compression
DEBUG:lib.cuckoo.core.plugins: |-- decryption
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- decryption
DEBUG:lib.cuckoo.core.plugins: |-- doppelganging
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- doppelganging
DEBUG:lib.cuckoo.core.plugins: |-- evil_grab
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- evil_grab
DEBUG:lib.cuckoo.core.plugins: |-- injection_inter_process
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_inter_process
DEBUG:lib.cuckoo.core.plugins: |-- injection_create_remote_thread
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_create_remote_thread
DEBUG:lib.cuckoo.core.plugins: |-- injection_process_hollowing
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_process_hollowing
DEBUG:lib.cuckoo.core.plugins: |-- injection_set_window_long
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_set_window_long
DEBUG:lib.cuckoo.core.plugins: |-- plugx
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- plugx
DEBUG:lib.cuckoo.core.plugins: |-- reg_binary
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- reg_binary
DEBUG:lib.cuckoo.core.plugins: |-- transacted_hollowing
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- transacted_hollowing
DEBUG:lib.cuckoo.core.plugins: |-- unpacker
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- unpacker
DEBUG:lib.cuckoo.core.plugins: |-- alphacrypt_behavior
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- alphacrypt_behavior
DEBUG:lib.cuckoo.core.plugins: |-- andromeda_behavior
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- andromeda_behavior
DEBUG:lib.cuckoo.core.plugins: |-- anomalous_deletefile
2022-09-15 15:12:47,245 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- anomalous_deletefile
DEBUG:lib.cuckoo.core.plugins: |-- antiav_360_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_360_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_ahnlab_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_ahnlab_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_avast_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_avast_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_bitdefender_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_bitdefender_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_bullgaurd_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_bullgaurd_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_emsisoft_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_emsisoft_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_qurb_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_qurb_libs
DEBUG:lib.cuckoo.core.plugins: |-- antiav_servicestop
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_servicestop
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_addvectoredexceptionhandler
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_addvectoredexceptionhandler
DEBUG:lib.cuckoo.core.plugins: |-- antiav_apioverride_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_apioverride_libs
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_checkremotedebuggerpresent
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_checkremotedebuggerpresent
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_debugactiveprocess
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_debugactiveprocess
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_gettickcount
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_gettickcount
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_guardpages
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_guardpages
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_ntcreatethreadex
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_ntcreatethreadex
DEBUG:lib.cuckoo.core.plugins: |-- antiav_nthookengine_libs
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiav_nthookengine_libs
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_ntsetinformationthread
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_ntsetinformationthread
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_outputdebugstring
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_outputdebugstring
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_setunhandledexceptionfilter
2022-09-15 15:12:47,246 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_setunhandledexceptionfilter
DEBUG:lib.cuckoo.core.plugins: |-- antidebug_windows
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antidebug_windows
DEBUG:lib.cuckoo.core.plugins: |-- antiemu_wine_func
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antiemu_wine_func
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_check_userdomain
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_check_userdomain
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_cuckoo
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_cuckoo
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_cuckoocrash
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_cuckoocrash
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_foregroundwindows
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_foregroundwindows
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_mouse_hook
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_mouse_hook
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_restart
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_restart
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sboxie_libs
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sboxie_libs
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sboxie_objects
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sboxie_objects
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_script_timer
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_script_timer
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sleep
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sleep
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_sunbelt_libs
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_sunbelt_libs
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_suspend
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_suspend
DEBUG:lib.cuckoo.core.plugins: |-- antisandbox_unhook
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antisandbox_unhook
DEBUG:lib.cuckoo.core.plugins: |-- antivm_directory_objects
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_directory_objects
DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_disk
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_disk
DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_disk_setupapi
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_disk_setupapi
DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_scsi
2022-09-15 15:12:47,247 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_scsi
DEBUG:lib.cuckoo.core.plugins: |-- antivm_generic_services
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_generic_services
DEBUG:lib.cuckoo.core.plugins: |-- antivm_network_adapters
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_network_adapters
DEBUG:lib.cuckoo.core.plugins: |-- antivm_vbox_libs
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vbox_libs
DEBUG:lib.cuckoo.core.plugins: |-- antivm_vbox_provname
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vbox_provname
DEBUG:lib.cuckoo.core.plugins: |-- antivm_vbox_window
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vbox_window
DEBUG:lib.cuckoo.core.plugins: |-- antivm_vmware_events
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vmware_events
DEBUG:lib.cuckoo.core.plugins: |-- antivm_vmware_libs
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- antivm_vmware_libs
DEBUG:lib.cuckoo.core.plugins: |-- api_spamming
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- api_spamming
DEBUG:lib.cuckoo.core.plugins: |-- banker_prinimalka
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- banker_prinimalka
DEBUG:lib.cuckoo.core.plugins: |-- bcdedit_command
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- bcdedit_command
DEBUG:lib.cuckoo.core.plugins: |-- betabot_behavior
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- betabot_behavior
DEBUG:lib.cuckoo.core.plugins: |-- bootkit
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- bootkit
DEBUG:lib.cuckoo.core.plugins: |-- potential_overwrite_mbr
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- potential_overwrite_mbr
DEBUG:lib.cuckoo.core.plugins: |-- suspicious_ioctl_scsipassthough
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- suspicious_ioctl_scsipassthough
DEBUG:lib.cuckoo.core.plugins: |-- browser_needed
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- browser_needed
DEBUG:lib.cuckoo.core.plugins: |-- browser_scanbox
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- browser_scanbox
DEBUG:lib.cuckoo.core.plugins: |-- firefox_disables_process_tab
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- firefox_disables_process_tab
DEBUG:lib.cuckoo.core.plugins: |-- regsvr32_squiblydoo_dll_load
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- regsvr32_squiblydoo_dll_load
DEBUG:lib.cuckoo.core.plugins: |-- uac_bypass_cmstp
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- uac_bypass_cmstp
DEBUG:lib.cuckoo.core.plugins: |-- uac_bypass_eventvwr
2022-09-15 15:12:47,248 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- uac_bypass_eventvwr
DEBUG:lib.cuckoo.core.plugins: |-- cerber_behavior
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cerber_behavior
DEBUG:lib.cuckoo.core.plugins: |-- chimera_behavior
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- chimera_behavior
DEBUG:lib.cuckoo.core.plugins: |-- clickfraud_cookies
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- clickfraud_cookies
DEBUG:lib.cuckoo.core.plugins: |-- clickfraud_volume
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- clickfraud_volume
DEBUG:lib.cuckoo.core.plugins: |-- dotnet_code_compile
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dotnet_code_compile
DEBUG:lib.cuckoo.core.plugins: |-- creates_largekey
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- creates_largekey
DEBUG:lib.cuckoo.core.plugins: |-- creates_nullvalue
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- creates_nullvalue
DEBUG:lib.cuckoo.core.plugins: |-- lsass_credential_dumping
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- lsass_credential_dumping
DEBUG:lib.cuckoo.core.plugins: |-- critical_process
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- critical_process
DEBUG:lib.cuckoo.core.plugins: |-- generates_crypto_key
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- generates_crypto_key
DEBUG:lib.cuckoo.core.plugins: |-- cryptowall_behavior
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cryptowall_behavior
DEBUG:lib.cuckoo.core.plugins: |-- cve_2014_6332
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2014_6332
DEBUG:lib.cuckoo.core.plugins: |-- cve_2015_2419_js
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2015_2419_js
DEBUG:lib.cuckoo.core.plugins: |-- cve_2016-0189
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2016-0189
DEBUG:lib.cuckoo.core.plugins: |-- cve_2016_7200
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cve_2016_7200
DEBUG:lib.cuckoo.core.plugins: |-- dead_connect
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dead_connect
DEBUG:lib.cuckoo.core.plugins: |-- dead_link
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dead_link
DEBUG:lib.cuckoo.core.plugins: |-- debugs_self
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- debugs_self
DEBUG:lib.cuckoo.core.plugins: |-- decoy_document
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- decoy_document
DEBUG:lib.cuckoo.core.plugins: |-- decoy_image
2022-09-15 15:12:47,249 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- decoy_image
DEBUG:lib.cuckoo.core.plugins: |-- deletes_self
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- deletes_self
DEBUG:lib.cuckoo.core.plugins: |-- deletes_shadow_copies
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- deletes_shadow_copies
DEBUG:lib.cuckoo.core.plugins: |-- deletes_system_state_backup
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- deletes_system_state_backup
DEBUG:lib.cuckoo.core.plugins: |-- dep_bypass
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dep_bypass
DEBUG:lib.cuckoo.core.plugins: |-- dep_disable
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dep_disable
DEBUG:lib.cuckoo.core.plugins: |-- disables_mappeddrives_autodisconnect
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- disables_mappeddrives_autodisconnect
DEBUG:lib.cuckoo.core.plugins: |-- disables_spdy
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- disables_spdy
DEBUG:lib.cuckoo.core.plugins: |-- disables_wfp
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- disables_wfp
DEBUG:lib.cuckoo.core.plugins: |-- dll_load_uncommon_file_types
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dll_load_uncommon_file_types
DEBUG:lib.cuckoo.core.plugins: |-- document_script_exe_drop
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- document_script_exe_drop
DEBUG:lib.cuckoo.core.plugins: |-- guloader_apis
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- guloader_apis
DEBUG:lib.cuckoo.core.plugins: |-- dridex_behavior
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dridex_behavior
DEBUG:lib.cuckoo.core.plugins: |-- driver_load
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- driver_load
DEBUG:lib.cuckoo.core.plugins: |-- exe_dropper_js
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exe_dropper_js
DEBUG:lib.cuckoo.core.plugins: |-- dynamic_function_loading
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dynamic_function_loading
DEBUG:lib.cuckoo.core.plugins: |-- angler_js
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- angler_js
DEBUG:lib.cuckoo.core.plugins: |-- gondad_js
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- gondad_js
DEBUG:lib.cuckoo.core.plugins: |-- heapspray_js
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- heapspray_js
DEBUG:lib.cuckoo.core.plugins: |-- java_js
2022-09-15 15:12:47,250 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- java_js
DEBUG:lib.cuckoo.core.plugins: |-- neutrino_js
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- neutrino_js
DEBUG:lib.cuckoo.core.plugins: |-- nuclear_js
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nuclear_js
DEBUG:lib.cuckoo.core.plugins: |-- rig_js
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- rig_js
DEBUG:lib.cuckoo.core.plugins: |-- silverlight_js
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- silverlight_js
DEBUG:lib.cuckoo.core.plugins: |-- sundown_js
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- sundown_js
DEBUG:lib.cuckoo.core.plugins: |-- virtualcheck_js
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- virtualcheck_js
DEBUG:lib.cuckoo.core.plugins: |-- encrypted_ioc
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypted_ioc
DEBUG:lib.cuckoo.core.plugins: |-- exec_crash
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exec_crash
DEBUG:lib.cuckoo.core.plugins: |-- process_creation_suspicious_location
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- process_creation_suspicious_location
DEBUG:lib.cuckoo.core.plugins: |-- exploit_getbasekerneladdress
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exploit_getbasekerneladdress
DEBUG:lib.cuckoo.core.plugins: |-- exploit_gethaldispatchtable
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exploit_gethaldispatchtable
DEBUG:lib.cuckoo.core.plugins: |-- exploit_heapspray
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- exploit_heapspray
DEBUG:lib.cuckoo.core.plugins: |-- koadic_apis
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- koadic_apis
DEBUG:lib.cuckoo.core.plugins: |-- koadic_network_activity
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- koadic_network_activity
DEBUG:lib.cuckoo.core.plugins: |-- downloads_from_filehosting
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- downloads_from_filehosting
DEBUG:lib.cuckoo.core.plugins: |-- generic_phish
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- generic_phish
DEBUG:lib.cuckoo.core.plugins: |-- gootkit_behavior
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- gootkit_behavior
DEBUG:lib.cuckoo.core.plugins: |-- h1n1_behavior
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- h1n1_behavior
DEBUG:lib.cuckoo.core.plugins: |-- hancitor_behavior
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- hancitor_behavior
DEBUG:lib.cuckoo.core.plugins: |-- hawkeye_behavior
2022-09-15 15:12:47,251 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- hawkeye_behavior
DEBUG:lib.cuckoo.core.plugins: |-- http_request
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- http_request
DEBUG:lib.cuckoo.core.plugins: |-- https_urls
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- https_urls
DEBUG:lib.cuckoo.core.plugins: |-- infostealer_browser
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- infostealer_browser
DEBUG:lib.cuckoo.core.plugins: |-- infostealer_browser_password
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- infostealer_browser_password
DEBUG:lib.cuckoo.core.plugins: |-- cryptbot_network
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- cryptbot_network
DEBUG:lib.cuckoo.core.plugins: |-- infostealer_keylog
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- infostealer_keylog
DEBUG:lib.cuckoo.core.plugins: |-- masslogger_artifacts
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- masslogger_artifacts
DEBUG:lib.cuckoo.core.plugins: |-- masslogger_version
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- masslogger_version
DEBUG:lib.cuckoo.core.plugins: |-- purplewave_network_activity
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- purplewave_network_activity
DEBUG:lib.cuckoo.core.plugins: |-- quilclipper_behavior
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- quilclipper_behavior
DEBUG:lib.cuckoo.core.plugins: |-- raccoon_behavior
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- raccoon_behavior
DEBUG:lib.cuckoo.core.plugins: |-- captures_screenshot
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- captures_screenshot
DEBUG:lib.cuckoo.core.plugins: |-- vidar_behavior
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- vidar_behavior
DEBUG:lib.cuckoo.core.plugins: |-- injection_createremotethread
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_createremotethread
DEBUG:lib.cuckoo.core.plugins: |-- injection_explorer
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_explorer
DEBUG:lib.cuckoo.core.plugins: |-- injection_needextension
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_needextension
DEBUG:lib.cuckoo.core.plugins: |-- injection_network_traffic
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_network_traffic
DEBUG:lib.cuckoo.core.plugins: |-- injection_runpe
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_runpe
DEBUG:lib.cuckoo.core.plugins: |-- injection_rwx
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_rwx
DEBUG:lib.cuckoo.core.plugins: |-- injection_themeinitapihook
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- injection_themeinitapihook
DEBUG:lib.cuckoo.core.plugins: |-- internet_dropper
2022-09-15 15:12:47,252 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- internet_dropper
DEBUG:lib.cuckoo.core.plugins: |-- ipc_namedpipe
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ipc_namedpipe
DEBUG:lib.cuckoo.core.plugins: |-- js_phish
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- js_phish
DEBUG:lib.cuckoo.core.plugins: |-- js_suspicious_redirect
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- js_suspicious_redirect
DEBUG:lib.cuckoo.core.plugins: |-- kazybot_behavior
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kazybot_behavior
DEBUG:lib.cuckoo.core.plugins: |-- kelihos_behavior
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kelihos_behavior
DEBUG:lib.cuckoo.core.plugins: |-- kibex_behavior
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kibex_behavior
DEBUG:lib.cuckoo.core.plugins: |-- kovter_behavior
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- kovter_behavior
DEBUG:lib.cuckoo.core.plugins: |-- locky_behavior
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- locky_behavior
DEBUG:lib.cuckoo.core.plugins: |-- malicious_dynamic_function_loading
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- malicious_dynamic_function_loading
DEBUG:lib.cuckoo.core.plugins: |-- encrypt_pcinfo
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_pcinfo
DEBUG:lib.cuckoo.core.plugins: |-- encrypt_data_agenttesla_http
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_data_agenttesla_http
DEBUG:lib.cuckoo.core.plugins: |-- encrypt_data_agentteslat2_http
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_data_agentteslat2_http
DEBUG:lib.cuckoo.core.plugins: |-- encrypt_data_nanocore
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- encrypt_data_nanocore
DEBUG:lib.cuckoo.core.plugins: |-- mimics_agent
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- mimics_agent
DEBUG:lib.cuckoo.core.plugins: |-- mimics_filetime
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- mimics_filetime
DEBUG:lib.cuckoo.core.plugins: |-- quilclipper_behavior
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- quilclipper_behavior
DEBUG:lib.cuckoo.core.plugins: |-- modify_desktop_wallpaper
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- modify_desktop_wallpaper
DEBUG:lib.cuckoo.core.plugins: |-- modify_zoneid_ads
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- modify_zoneid_ads
DEBUG:lib.cuckoo.core.plugins: |-- move_file_on_reboot
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- move_file_on_reboot
DEBUG:lib.cuckoo.core.plugins: |-- multiple_useragents
2022-09-15 15:12:47,253 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- multiple_useragents
DEBUG:lib.cuckoo.core.plugins: |-- network_anomaly
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_anomaly
DEBUG:lib.cuckoo.core.plugins: |-- network_bind
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_bind
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_archive
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_archive
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_free_webshoting
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_free_webshoting
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_generic
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_generic
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_temp_urldns
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_temp_urldns
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_pastesite
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_pastesite
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_payload
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_payload
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_socialmedia
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_socialmedia
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_telegram
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_telegram
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_tempstorage
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_tempstorage
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_temp_urldns
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_temp_urldns
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_urlshortener
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_urlshortener
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_https_useragent
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_https_useragent
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_smtps_exfil
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_smtps_exfil
DEBUG:lib.cuckoo.core.plugins: |-- network_cnc_smtps_generic
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_cnc_smtps_generic
DEBUG:lib.cuckoo.core.plugins: |-- network_dns_idn
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_dns_idn
DEBUG:lib.cuckoo.core.plugins: |-- network_dns_suspicious_querytype
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_dns_suspicious_querytype
DEBUG:lib.cuckoo.core.plugins: |-- network_dns_tunneling_request
2022-09-15 15:12:47,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_dns_tunneling_request
DEBUG:lib.cuckoo.core.plugins: |-- network_document_http
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_document_http
DEBUG:lib.cuckoo.core.plugins: |-- explorer_http
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- explorer_http
DEBUG:lib.cuckoo.core.plugins: |-- network_fake_useragent
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_fake_useragent
DEBUG:lib.cuckoo.core.plugins: |-- network_document_file
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_document_file
DEBUG:lib.cuckoo.core.plugins: |-- network_downloader_exe
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_downloader_exe
DEBUG:lib.cuckoo.core.plugins: |-- network_tor
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- network_tor
DEBUG:lib.cuckoo.core.plugins: |-- nymaim_behavior
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nymaim_behavior
DEBUG:lib.cuckoo.core.plugins: |-- office_com_load
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_com_load
DEBUG:lib.cuckoo.core.plugins: |-- office_dotnet_load
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_dotnet_load
DEBUG:lib.cuckoo.core.plugins: |-- office_mshtml_load
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_mshtml_load
DEBUG:lib.cuckoo.core.plugins: |-- office_vb_load
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_vb_load
DEBUG:lib.cuckoo.core.plugins: |-- office_wmi_load
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_wmi_load
DEBUG:lib.cuckoo.core.plugins: |-- office_cve2017_11882
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve2017_11882
DEBUG:lib.cuckoo.core.plugins: |-- office_cve2017_11882_network
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve2017_11882_network
DEBUG:lib.cuckoo.core.plugins: |-- office_cve_2021_40444
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve_2021_40444
DEBUG:lib.cuckoo.core.plugins: |-- office_cve_2021_40444_m2
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_cve_2021_40444_m2
DEBUG:lib.cuckoo.core.plugins: |-- office_flash_load
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_flash_load
DEBUG:lib.cuckoo.core.plugins: |-- office_postscript
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_postscript
DEBUG:lib.cuckoo.core.plugins: |-- office_suspicious_processes
2022-09-15 15:12:47,255 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_suspicious_processes
DEBUG:lib.cuckoo.core.plugins: |-- office_write_exe
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- office_write_exe
DEBUG:lib.cuckoo.core.plugins: |-- packer_themida
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- packer_themida
DEBUG:lib.cuckoo.core.plugins: |-- persistence_autorun
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_autorun
DEBUG:lib.cuckoo.core.plugins: |-- persistence_autorun_tasks
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_autorun_tasks
DEBUG:lib.cuckoo.core.plugins: |-- persistence_bootexecute
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_bootexecute
DEBUG:lib.cuckoo.core.plugins: |-- persistence_registry_script
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persistence_registry_script
DEBUG:lib.cuckoo.core.plugins: |-- pony_behavior
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- pony_behavior
DEBUG:lib.cuckoo.core.plugins: |-- powershell_network_connection
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- powershell_network_connection
DEBUG:lib.cuckoo.core.plugins: |-- powershell_download
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- powershell_download
DEBUG:lib.cuckoo.core.plugins: |-- powershell_request
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- powershell_request
DEBUG:lib.cuckoo.core.plugins: |-- createtoolhelp32snapshot_module_enumeration
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- createtoolhelp32snapshot_module_enumeration
DEBUG:lib.cuckoo.core.plugins: |-- enumerates_running_processes
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- enumerates_running_processes
DEBUG:lib.cuckoo.core.plugins: |-- process_interest
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- process_interest
DEBUG:lib.cuckoo.core.plugins: |-- process_needed
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- process_needed
DEBUG:lib.cuckoo.core.plugins: |-- mass_data_encryption
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- mass_data_encryption
DEBUG:lib.cuckoo.core.plugins: |-- ransomware_dmalocker
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ransomware_dmalocker
DEBUG:lib.cuckoo.core.plugins: |-- ransomware_file_modifications
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ransomware_file_modifications
DEBUG:lib.cuckoo.core.plugins: |-- ransomware_message
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ransomware_message
DEBUG:lib.cuckoo.core.plugins: |-- nemty_network_activity
2022-09-15 15:12:47,256 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nemty_network_activity
DEBUG:lib.cuckoo.core.plugins: |-- nemty_note
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- nemty_note
DEBUG:lib.cuckoo.core.plugins: |-- sodinokibi_behavior
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- sodinokibi_behavior
DEBUG:lib.cuckoo.core.plugins: |-- stop_ransomware_registry
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stop_ransomware_registry
DEBUG:lib.cuckoo.core.plugins: |-- blackrat_apis
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- blackrat_apis
DEBUG:lib.cuckoo.core.plugins: |-- blackrat_network_activity
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- blackrat_network_activity
DEBUG:lib.cuckoo.core.plugins: |-- blackrat_registry_keys
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- blackrat_registry_keys
DEBUG:lib.cuckoo.core.plugins: |-- dcrat_behavior
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- dcrat_behavior
DEBUG:lib.cuckoo.core.plugins: |-- karagany_system_event_objects
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- karagany_system_event_objects
DEBUG:lib.cuckoo.core.plugins: |-- rat_luminosity
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- rat_luminosity
DEBUG:lib.cuckoo.core.plugins: |-- rat_nanocore
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- rat_nanocore
DEBUG:lib.cuckoo.core.plugins: |-- netwire_behavior
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- netwire_behavior
DEBUG:lib.cuckoo.core.plugins: |-- obliquerat_network_activity
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- obliquerat_network_activity
DEBUG:lib.cuckoo.core.plugins: |-- orcusrat_behavior
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- orcusrat_behavior
DEBUG:lib.cuckoo.core.plugins: |-- trochilusrat_apis
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- trochilusrat_apis
DEBUG:lib.cuckoo.core.plugins: |-- reads_self
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- reads_self
DEBUG:lib.cuckoo.core.plugins: |-- recon_beacon
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- recon_beacon
DEBUG:lib.cuckoo.core.plugins: |-- recon_programs
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- recon_programs
DEBUG:lib.cuckoo.core.plugins: |-- recon_systeminfo
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- recon_systeminfo
DEBUG:lib.cuckoo.core.plugins: |-- accesses_recyclebin
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- accesses_recyclebin
DEBUG:lib.cuckoo.core.plugins: |-- removes_zoneid_ads
2022-09-15 15:12:47,257 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- removes_zoneid_ads
DEBUG:lib.cuckoo.core.plugins: |-- script_created_process
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- script_created_process
DEBUG:lib.cuckoo.core.plugins: |-- script_network_activity
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- script_network_activity
DEBUG:lib.cuckoo.core.plugins: |-- suspicious_js_script
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- suspicious_js_script
DEBUG:lib.cuckoo.core.plugins: |-- secure_login_phishing
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- secure_login_phishing
DEBUG:lib.cuckoo.core.plugins: |-- securityxploded_modules
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- securityxploded_modules
DEBUG:lib.cuckoo.core.plugins: |-- get_clipboard_data
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- get_clipboard_data
DEBUG:lib.cuckoo.core.plugins: |-- sets_autoconfig_url
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- sets_autoconfig_url
DEBUG:lib.cuckoo.core.plugins: |-- shifu_behavior
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- shifu_behavior
DEBUG:lib.cuckoo.core.plugins: |-- spoofs_procname
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- spoofs_procname
DEBUG:lib.cuckoo.core.plugins: |-- stack_pivot
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stack_pivot
DEBUG:lib.cuckoo.core.plugins: |-- stack_pivot_file_created
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stack_pivot_file_created
DEBUG:lib.cuckoo.core.plugins: |-- stack_pivot_process_create
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stack_pivot_process_create
DEBUG:lib.cuckoo.core.plugins: |-- set_clipboard_data
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- set_clipboard_data
DEBUG:lib.cuckoo.core.plugins: |-- stealth_childproc
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_childproc
DEBUG:lib.cuckoo.core.plugins: |-- stealth_file
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_file
DEBUG:lib.cuckoo.core.plugins: |-- stealth_network
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_network
DEBUG:lib.cuckoo.core.plugins: |-- stealth_system_procname
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_system_procname
DEBUG:lib.cuckoo.core.plugins: |-- stealth_timeout
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_timeout
DEBUG:lib.cuckoo.core.plugins: |-- stealth_window
2022-09-15 15:12:47,258 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- stealth_window
DEBUG:lib.cuckoo.core.plugins: |-- terminates_remote_process
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- terminates_remote_process
DEBUG:lib.cuckoo.core.plugins: |-- tinba_behavior
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- tinba_behavior
DEBUG:lib.cuckoo.core.plugins: |-- trickbot_task_delete
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- trickbot_task_delete
DEBUG:lib.cuckoo.core.plugins: |-- upatre_behavior
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- upatre_behavior
DEBUG:lib.cuckoo.core.plugins: |-- ursnif_behavior
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- ursnif_behavior
DEBUG:lib.cuckoo.core.plugins: |-- user_enum
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- user_enum
DEBUG:lib.cuckoo.core.plugins: |-- vawtrak_behavior
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- vawtrak_behavior
DEBUG:lib.cuckoo.core.plugins: |-- vawtrak_behavior
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- vawtrak_behavior
DEBUG:lib.cuckoo.core.plugins: |-- virus
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- virus
DEBUG:lib.cuckoo.core.plugins: |-- neshta_files
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- neshta_files
DEBUG:lib.cuckoo.core.plugins: |-- neshta_regkeys
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- neshta_regkeys
DEBUG:lib.cuckoo.core.plugins: |-- webmail_phish
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- webmail_phish
DEBUG:lib.cuckoo.core.plugins: |-- persists_dev_util
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- persists_dev_util
DEBUG:lib.cuckoo.core.plugins: |-- spawns_dev_util
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- spawns_dev_util
DEBUG:lib.cuckoo.core.plugins: |-- alters_windows_utility
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- alters_windows_utility
DEBUG:lib.cuckoo.core.plugins: |-- overwrites_accessibility_utility
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- overwrites_accessibility_utility
DEBUG:lib.cuckoo.core.plugins: |-- wiper_zeroedbytes
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- wiper_zeroedbytes
DEBUG:lib.cuckoo.core.plugins: |-- wmi_create_process
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- wmi_create_process
DEBUG:lib.cuckoo.core.plugins: |-- wmi_script_process
2022-09-15 15:12:47,259 [Task 28] [lib.cuckoo.core.plugins] DEBUG: |-- wmi_script_process
DEBUG:lib.cuckoo.core.plugins: -- win32_process_create 2022-09-15 15:12:47,260 [Task 28] [lib.cuckoo.core.plugins] DEBUG:
-- win32_process_create
DEBUG:lib.cuckoo.core.plugins:Running non-evented signatures
2022-09-15 15:12:49,778 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running non-evented signatures
DEBUG:lib.cuckoo.core.plugins:Running signature "cape_detected_threat"
2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_detected_threat"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "cape_detected_threat"
2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "cape_detected_threat"
DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_mailslot"
2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_mailslot"
DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_netlogon_regkey"
2022-09-15 15:12:49,779 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_netlogon_regkey"
DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_sysvol"
2022-09-15 15:12:49,780 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_sysvol"
DEBUG:lib.cuckoo.core.plugins:Running signature "writes_sysvol"
2022-09-15 15:12:49,781 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "writes_sysvol"
DEBUG:lib.cuckoo.core.plugins:Running signature "adds_admin_user"
2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "adds_admin_user"
DEBUG:lib.cuckoo.core.plugins:Running signature "adds_user"
2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "adds_user"
DEBUG:lib.cuckoo.core.plugins:Running signature "overwrites_admin_password"
2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "overwrites_admin_password"
DEBUG:lib.cuckoo.core.plugins:Running signature "antianalysis_detectfile"
2022-09-15 15:12:49,782 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antianalysis_detectfile"
DEBUG:lib.cuckoo.core.plugins:Running signature "antianalysis_detectreg"
2022-09-15 15:12:49,792 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antianalysis_detectreg"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_attachment_manager"
2022-09-15 15:12:49,972 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_attachment_manager"
DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_detectfile"
2022-09-15 15:12:49,972 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_detectfile"
DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_detectreg"
2022-09-15 15:12:49,998 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_detectreg"
DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_srp"
2022-09-15 15:12:50,822 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_srp"
DEBUG:lib.cuckoo.core.plugins:Running signature "antiav_whitespace"
2022-09-15 15:12:50,822 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiav_whitespace"
DEBUG:lib.cuckoo.core.plugins:Running signature "antidebug_devices"
2022-09-15 15:12:50,823 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antidebug_devices"
DEBUG:lib.cuckoo.core.plugins:Running signature "antiemu_windefend"
2022-09-15 15:12:50,826 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiemu_windefend"
DEBUG:lib.cuckoo.core.plugins:Running signature "antiemu_wine_reg"
2022-09-15 15:12:50,827 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antiemu_wine_reg"
DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_cuckoo_files"
2022-09-15 15:12:50,828 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_cuckoo_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_fortinet_files"
2022-09-15 15:12:50,828 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_fortinet_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_joe_anubis_files"
2022-09-15 15:12:50,829 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_joe_anubis_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_sboxie_mutex"
2022-09-15 15:12:50,830 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_sboxie_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_sunbelt_files"
2022-09-15 15:12:50,830 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_sunbelt_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antisandbox_threattrack_files"
2022-09-15 15:12:50,831 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antisandbox_threattrack_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivirus_clamav"
2022-09-15 15:12:50,831 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivirus_clamav"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivirus_virustotal"
2022-09-15 15:12:50,832 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivirus_virustotal"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_bochs_keys"
2022-09-15 15:12:50,832 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_bochs_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_bios"
2022-09-15 15:12:50,847 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_bios"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_cpu"
2022-09-15 15:12:50,862 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_cpu"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_diskreg"
2022-09-15 15:12:50,863 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_diskreg"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_generic_system"
2022-09-15 15:12:50,899 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_generic_system"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_hyperv_keys"
2022-09-15 15:12:50,909 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_hyperv_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_parallels_keys"
2022-09-15 15:12:50,929 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_parallels_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vbox_devices"
2022-09-15 15:12:50,979 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vbox_devices"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vbox_files"
2022-09-15 15:12:50,981 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vbox_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vbox_keys"
2022-09-15 15:12:50,992 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vbox_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_devices"
2022-09-15 15:12:51,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_devices"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_files"
2022-09-15 15:12:51,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_keys"
2022-09-15 15:12:51,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vmware_mutexes"
2022-09-15 15:12:51,154 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vmware_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vpc_files"
2022-09-15 15:12:51,154 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vpc_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vpc_keys"
2022-09-15 15:12:51,155 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vpc_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_vpc_mutex"
2022-09-15 15:12:51,186 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_vpc_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "antivm_xen_keys"
2022-09-15 15:12:51,187 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "antivm_xen_keys"
DEBUG:lib.cuckoo.core.plugins:Running signature "gulpix_behavior"
2022-09-15 15:12:51,235 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "gulpix_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "ketrican_regkeys"
2022-09-15 15:12:51,236 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ketrican_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "okrum_mutexes"
2022-09-15 15:12:51,239 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "okrum_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "bad_certs"
2022-09-15 15:12:51,239 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bad_certs"
DEBUG:lib.cuckoo.core.plugins:Running signature "bad_ssl_certs"
2022-09-15 15:12:51,239 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bad_ssl_certs"
DEBUG:lib.cuckoo.core.plugins:Running signature "banker_cridex"
2022-09-15 15:12:51,240 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_cridex"
DEBUG:lib.cuckoo.core.plugins:Running signature "geodo_banking_trojan"
2022-09-15 15:12:51,241 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "geodo_banking_trojan"
DEBUG:lib.cuckoo.core.plugins:Running signature "banker_spyeye_mutexes"
2022-09-15 15:12:51,263 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_spyeye_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "banker_zeus_mutex"
2022-09-15 15:12:51,263 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_zeus_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "banker_zeus_p2p"
2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_zeus_p2p"
DEBUG:lib.cuckoo.core.plugins:Running signature "banker_zeus_url"
2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "banker_zeus_url"
DEBUG:lib.cuckoo.core.plugins:Running signature "bitcoin_opencl"
2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bitcoin_opencl"
DEBUG:lib.cuckoo.core.plugins:Running signature "accesses_primary_patition"
2022-09-15 15:12:51,264 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "accesses_primary_patition"
DEBUG:lib.cuckoo.core.plugins:Running signature "direct_hdd_access"
2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "direct_hdd_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "physical_drive_access"
2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "physical_drive_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_athenahttp"
2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_athenahttp"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_dirtjumper"
2022-09-15 15:12:51,265 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_dirtjumper"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_drive"
2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_drive"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_drive2"
2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_drive2"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_madness"
2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_madness"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_russkill"
2022-09-15 15:12:51,266 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_russkill"
DEBUG:lib.cuckoo.core.plugins:Running signature "browser_addon"
2022-09-15 15:12:51,267 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_addon"
DEBUG:lib.cuckoo.core.plugins:Running signature "browser_helper_object"
2022-09-15 15:12:51,269 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_helper_object"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_proxy"
2022-09-15 15:12:51,269 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_proxy"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "modify_proxy"
2022-09-15 15:12:51,270 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "modify_proxy"
DEBUG:lib.cuckoo.core.plugins:Running signature "browser_security"
2022-09-15 15:12:51,270 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_security"
DEBUG:lib.cuckoo.core.plugins:Running signature "browser_startpage"
2022-09-15 15:12:51,276 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "browser_startpage"
DEBUG:lib.cuckoo.core.plugins:Running signature "ie_disables_process_tab"
2022-09-15 15:12:51,277 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ie_disables_process_tab"
DEBUG:lib.cuckoo.core.plugins:Running signature "odbcconf_bypass"
2022-09-15 15:12:51,277 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "odbcconf_bypass"
DEBUG:lib.cuckoo.core.plugins:Running signature "squiblydoo_bypass"
2022-09-15 15:12:51,278 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "squiblydoo_bypass"
DEBUG:lib.cuckoo.core.plugins:Running signature "squiblytwo_bypass"
2022-09-15 15:12:51,278 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "squiblytwo_bypass"
DEBUG:lib.cuckoo.core.plugins:Running signature "bypass_firewall"
2022-09-15 15:12:51,278 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bypass_firewall"
DEBUG:lib.cuckoo.core.plugins:Running signature "uac_bypass_cmstpcom"
2022-09-15 15:12:51,293 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uac_bypass_cmstpcom"
DEBUG:lib.cuckoo.core.plugins:Running signature "uac_bypass_delegateexecute_sdclt"
2022-09-15 15:12:51,293 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uac_bypass_delegateexecute_sdclt"
DEBUG:lib.cuckoo.core.plugins:Running signature "uac_bypass_fodhelper"
2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uac_bypass_fodhelper"
DEBUG:lib.cuckoo.core.plugins:Running signature "cape_extracted_content"
2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_extracted_content"
DEBUG:lib.cuckoo.core.plugins:Running signature "cape_extracted_config"
2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_extracted_config"
DEBUG:lib.cuckoo.core.plugins:Running signature "cape_extracted_content"
2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cape_extracted_content"
DEBUG:lib.cuckoo.core.plugins:Running signature "carberp_mutex"
2022-09-15 15:12:51,294 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "carberp_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "clears_logs"
2022-09-15 15:12:51,295 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "clears_logs"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_obfuscation"
2022-09-15 15:12:51,295 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_obfuscation"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_switches"
2022-09-15 15:12:51,295 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_switches"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_terminate"
2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_terminate"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_forfiles_wildcard"
2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_forfiles_wildcard"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_http_link"
2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_http_link"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_long_string"
2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_long_string"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_reversed_http_link"
2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_reversed_http_link"
DEBUG:lib.cuckoo.core.plugins:Running signature "long_commandline"
2022-09-15 15:12:51,296 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "long_commandline"
DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_renamed_commandline"
2022-09-15 15:12:51,297 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_renamed_commandline"
DEBUG:lib.cuckoo.core.plugins:Running signature "codelux_behavior"
2022-09-15 15:12:51,297 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "codelux_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "system_account_discovery_cmd"
2022-09-15 15:12:51,298 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_account_discovery_cmd"
DEBUG:lib.cuckoo.core.plugins:Running signature "system_info_discovery_cmd"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_info_discovery_cmd"
DEBUG:lib.cuckoo.core.plugins:Running signature "system_info_discovery_pwsh"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_info_discovery_pwsh"
DEBUG:lib.cuckoo.core.plugins:Running signature "system_network_discovery_cmd"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_network_discovery_cmd"
DEBUG:lib.cuckoo.core.plugins:Running signature "system_network_discovery_pwsh"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_network_discovery_pwsh"
DEBUG:lib.cuckoo.core.plugins:Running signature "system_user_discovery_cmd"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "system_user_discovery_cmd"
DEBUG:lib.cuckoo.core.plugins:Running signature "copies_self"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "copies_self"
DEBUG:lib.cuckoo.core.plugins:Running signature "enables_wdigest"
2022-09-15 15:12:51,299 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "enables_wdigest"
DEBUG:lib.cuckoo.core.plugins:Running signature "file_credential_store_access"
2022-09-15 15:12:51,300 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "file_credential_store_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "file_credential_store_write"
2022-09-15 15:12:51,301 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "file_credential_store_write"
DEBUG:lib.cuckoo.core.plugins:Running signature "registry_credential_dumping"
2022-09-15 15:12:51,301 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "registry_credential_dumping"
DEBUG:lib.cuckoo.core.plugins:Running signature "registry_credential_store_access"
2022-09-15 15:12:51,301 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "registry_credential_store_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "registry_lsa_secrets_access"
2022-09-15 15:12:51,303 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "registry_lsa_secrets_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "cryptomining_stratum_command"
2022-09-15 15:12:51,304 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptomining_stratum_command"
DEBUG:lib.cuckoo.core.plugins:Running signature "cryptopool_domains"
2022-09-15 15:12:51,304 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptopool_domains"
DEBUG:lib.cuckoo.core.plugins:Running signature "cypherit_mutexes"
2022-09-15 15:12:51,305 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cypherit_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "darkcomet_regkeys"
2022-09-15 15:12:51,305 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "darkcomet_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "datop_loader"
2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "datop_loader"
DEBUG:lib.cuckoo.core.plugins:Running signature "deepfreeze_mutex"
2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "deepfreeze_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "deletes_executed_files"
2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "deletes_executed_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_app_launch"
2022-09-15 15:12:51,311 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_app_launch"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_auto_app_termination"
2022-09-15 15:12:51,312 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_auto_app_termination"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_appv_virtualization"
2022-09-15 15:12:51,312 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_appv_virtualization"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_backups"
2022-09-15 15:12:51,313 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_backups"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_browser_warn"
2022-09-15 15:12:51,314 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_browser_warn"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_context_menus"
2022-09-15 15:12:51,319 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_context_menus"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_cpl_disable"
2022-09-15 15:12:51,320 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_cpl_disable"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_event_logging"
2022-09-15 15:12:51,320 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_event_logging"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_folder_options"
2022-09-15 15:12:51,321 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_folder_options"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_notificationcenter"
2022-09-15 15:12:51,321 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_notificationcenter"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_power_options"
2022-09-15 15:12:51,322 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_power_options"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_restore_default_state"
2022-09-15 15:12:51,323 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_restore_default_state"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_run_command"
2022-09-15 15:12:51,323 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_run_command"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_security"
2022-09-15 15:12:51,323 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_security"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_smartscreen"
2022-09-15 15:12:51,324 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_smartscreen"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_startmenu_search"
2022-09-15 15:12:51,324 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_startmenu_search"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_system_restore"
2022-09-15 15:12:51,325 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_system_restore"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_uac"
2022-09-15 15:12:51,326 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_uac"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_wer"
2022-09-15 15:12:51,327 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_wer"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windows_defender"
2022-09-15 15:12:51,328 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windows_defender"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windows_defender_logging"
2022-09-15 15:12:51,330 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windows_defender_logging"
DEBUG:lib.cuckoo.core.plugins:Running signature "removes_windows_defender_contextmenu"
2022-09-15 15:12:51,331 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_windows_defender_contextmenu"
DEBUG:lib.cuckoo.core.plugins:Running signature "windows_defender_powershell"
2022-09-15 15:12:51,331 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "windows_defender_powershell"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windows_file_protection"
2022-09-15 15:12:51,332 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windows_file_protection"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_windowsupdate"
2022-09-15 15:12:51,332 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_windowsupdate"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_winfirewall"
2022-09-15 15:12:51,333 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_winfirewall"
DEBUG:lib.cuckoo.core.plugins:Running signature "andromut_mutexes"
2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "andromut_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "downloader_cabby"
2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "downloader_cabby"
DEBUG:lib.cuckoo.core.plugins:Running signature "phorpiex_mutexes"
2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "phorpiex_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "protonbot_mutexes"
2022-09-15 15:12:51,334 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "protonbot_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "driver_filtermanager"
2022-09-15 15:12:51,335 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "driver_filtermanager"
DEBUG:lib.cuckoo.core.plugins:Running signature "dropper"
2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dropper"
DEBUG:lib.cuckoo.core.plugins:Running signature "excel4_macro_urls"
2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "excel4_macro_urls"
DEBUG:lib.cuckoo.core.plugins:Running signature "spooler_access"
2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spooler_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "spooler_svc_start"
2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spooler_svc_start"
DEBUG:lib.cuckoo.core.plugins:Running signature "family_proxyback"
2022-09-15 15:12:51,336 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "family_proxyback"
DEBUG:lib.cuckoo.core.plugins:Running signature "mapped_drives_uac"
2022-09-15 15:12:51,337 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mapped_drives_uac"
DEBUG:lib.cuckoo.core.plugins:Running signature "hides_recycle_bin_icon"
2022-09-15 15:12:51,337 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "hides_recycle_bin_icon"
DEBUG:lib.cuckoo.core.plugins:Running signature "apocalypse_stealer_file_behavior"
2022-09-15 15:12:51,337 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "apocalypse_stealer_file_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "arkei_files"
2022-09-15 15:12:51,339 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "arkei_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "azorult_mutexes"
2022-09-15 15:12:51,339 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "azorult_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_bitcoin"
2022-09-15 15:12:51,340 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_bitcoin"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "infostealer_bitcoin"
2022-09-15 15:12:51,353 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "infostealer_bitcoin"
DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_cookies"
2022-09-15 15:12:51,353 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_cookies"
DEBUG:lib.cuckoo.core.plugins:Running signature "cryptbot_files"
2022-09-15 15:12:51,358 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptbot_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "echelon_files"
2022-09-15 15:12:51,361 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "echelon_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_ftp"
2022-09-15 15:12:51,362 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_ftp"
DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_im"
2022-09-15 15:12:51,642 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_im"
DEBUG:lib.cuckoo.core.plugins:Running signature "infostealer_mail"
2022-09-15 15:12:51,835 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "infostealer_mail"
DEBUG:lib.cuckoo.core.plugins:Running signature "masslogger_files"
2022-09-15 15:12:51,881 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "masslogger_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "poullight_files"
2022-09-15 15:12:51,882 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "poullight_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "purplewave_mutexes"
2022-09-15 15:12:51,888 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "purplewave_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "quilclipper_mutexes"
2022-09-15 15:12:51,889 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "quilclipper_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "qulab_files"
2022-09-15 15:12:51,889 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "qulab_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "qulab_mutexes"
2022-09-15 15:12:51,911 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "qulab_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "bot_kraken_mutexes"
2022-09-15 15:12:51,911 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "bot_kraken_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "locker_regedit"
2022-09-15 15:12:51,912 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "locker_regedit"
DEBUG:lib.cuckoo.core.plugins:Running signature "locker_taskmgr"
2022-09-15 15:12:51,913 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "locker_taskmgr"
DEBUG:lib.cuckoo.core.plugins:Running signature "ie_martian_children"
2022-09-15 15:12:51,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ie_martian_children"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_martian_children"
2022-09-15 15:12:51,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_martian_children"
DEBUG:lib.cuckoo.core.plugins:Running signature "mimics_extension"
2022-09-15 15:12:51,915 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mimics_extension"
DEBUG:lib.cuckoo.core.plugins:Running signature "mimics_icon"
2022-09-15 15:12:51,916 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mimics_icon"
DEBUG:lib.cuckoo.core.plugins:Running signature "masquerade_process_name"
2022-09-15 15:12:51,916 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "masquerade_process_name"
DEBUG:lib.cuckoo.core.plugins:Running signature "mimikatz_modules"
2022-09-15 15:12:52,022 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "mimikatz_modules"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_certs"
2022-09-15 15:12:52,022 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_certs"
DEBUG:lib.cuckoo.core.plugins:Running signature "dotnet_clr_usagelog_regkeys"
2022-09-15 15:12:52,023 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dotnet_clr_usagelog_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_hostfile"
2022-09-15 15:12:52,023 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_hostfile"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_oem_information"
2022-09-15 15:12:52,024 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_oem_information"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_security_center_warnings"
2022-09-15 15:12:52,024 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_security_center_warnings"
DEBUG:lib.cuckoo.core.plugins:Running signature "modify_uac_prompt"
2022-09-15 15:12:52,025 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modify_uac_prompt"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_country_distribution"
2022-09-15 15:12:52,027 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_country_distribution"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_multiple_direct_ip_connections"
2022-09-15 15:12:52,027 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_multiple_direct_ip_connections"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_multiple_direct_ip_connections"
2022-09-15 15:12:52,033 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_multiple_direct_ip_connections"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_cnc_http"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_cnc_http"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_http_post"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_http_post"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_ip_exe"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_ip_exe"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dga"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dga"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dga_fraunhofer"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dga_fraunhofer"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_blockchain"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_blockchain"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_opennic"
2022-09-15 15:12:52,034 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_opennic"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_paste_site"
2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_paste_site"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_reverse_proxy"
2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_reverse_proxy"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_temp_file_storage"
2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_temp_file_storage"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_temp_urldns"
2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_temp_urldns"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_url_shortener"
2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_url_shortener"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dns_doh_tls"
2022-09-15 15:12:52,035 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dns_doh_tls"
DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_tld"
2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_tld"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_dyndns"
2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_dyndns"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_excessive_udp"
2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_excessive_udp"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_excessive_udp"
2022-09-15 15:12:52,055 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_excessive_udp"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_http"
2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_http"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_icmp"
2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_icmp"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_icmp"
2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_icmp"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_irc"
2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_irc"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_open_proxy"
2022-09-15 15:12:52,056 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_open_proxy"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_p2p"
2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_p2p"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_questionable_http_path"
2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_questionable_http_path"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_questionable_https_path"
2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_questionable_https_path"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_smtp"
2022-09-15 15:12:52,086 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_smtp"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_tor_service"
2022-09-15 15:12:52,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_tor_service"
DEBUG:lib.cuckoo.core.plugins:Running signature "network_torgateway"
2022-09-15 15:12:52,087 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "network_torgateway"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_code_page"
2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_code_page"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_addinloading"
2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_addinloading"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_perfkey"
2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_perfkey"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro"
2022-09-15 15:12:52,088 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro"
DEBUG:lib.cuckoo.core.plugins:Running signature "changes_trust_center_settings"
2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "changes_trust_center_settings"
DEBUG:lib.cuckoo.core.plugins:Running signature "disables_vba_trust_access"
2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "disables_vba_trust_access"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_autoexecution"
2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_autoexecution"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_ioc"
2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_ioc"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_malicious_prediction"
2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_malicious_prediction"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_macro_suspicious"
2022-09-15 15:12:52,089 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_macro_suspicious"
DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_aslr_bypass"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_aslr_bypass"
DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_anomaly_characterset"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_anomaly_characterset"
DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_anomaly_version"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_anomaly_version"
DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_embedded_content"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_embedded_content"
DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_embedded_office_file"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_embedded_office_file"
DEBUG:lib.cuckoo.core.plugins:Running signature "rtf_exploit_static"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rtf_exploit_static"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_security"
2022-09-15 15:12:52,090 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_security"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_anomalous_feature"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_anomalous_feature"
DEBUG:lib.cuckoo.core.plugins:Running signature "office_dde_command"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "office_dde_command"
DEBUG:lib.cuckoo.core.plugins:Running signature "origin_langid"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "origin_langid"
DEBUG:lib.cuckoo.core.plugins:Running signature "origin_resource_langid"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "origin_resource_langid"
DEBUG:lib.cuckoo.core.plugins:Running signature "overlay"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "overlay"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_unknown_pe_section_name"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_unknown_pe_section_name"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_armadillo_mutex"
2022-09-15 15:12:52,092 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_armadillo_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_armadillo_regkey"
2022-09-15 15:12:52,093 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_armadillo_regkey"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_aspack"
2022-09-15 15:12:52,094 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_aspack"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_aspirecrypt"
2022-09-15 15:12:52,094 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_aspirecrypt"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_bedsprotector"
2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_bedsprotector"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_confuser"
2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_confuser"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_enigma"
2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_enigma"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_entropy"
2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_entropy"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_mpress"
2022-09-15 15:12:52,095 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_mpress"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_nate"
2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_nate"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_nspack"
2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_nspack"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_smartassembly"
2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_smartassembly"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_spices"
2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_spices"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_themida"
2022-09-15 15:12:52,096 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_themida"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_titan"
2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_titan"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_upx"
2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_upx"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_vmprotect"
2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_vmprotect"
DEBUG:lib.cuckoo.core.plugins:Running signature "packer_yoda"
2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "packer_yoda"
DEBUG:lib.cuckoo.core.plugins:Running signature "pdf_annot_urls"
2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "pdf_annot_urls"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_ads"
2022-09-15 15:12:52,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_ads"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_safeboot"
2022-09-15 15:12:52,098 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_safeboot"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_ifeo"
2022-09-15 15:12:52,099 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_ifeo"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_slient_process_exit"
2022-09-15 15:12:52,100 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_slient_process_exit"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_rdp_registry"
2022-09-15 15:12:52,100 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_rdp_registry"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_rdp_shadowing"
2022-09-15 15:12:52,100 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_rdp_shadowing"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_service"
2022-09-15 15:12:52,101 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_service"
DEBUG:lib.cuckoo.core.plugins:Running signature "persistence_shim_database"
2022-09-15 15:12:52,101 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "persistence_shim_database"
DEBUG:lib.cuckoo.core.plugins:Running signature "polymorphic"
2022-09-15 15:12:52,102 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "polymorphic"
DEBUG:lib.cuckoo.core.plugins:Running signature "powerpool_mutexes"
2022-09-15 15:12:52,102 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powerpool_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_scriptblock_logging"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_scriptblock_logging"
DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_command_suspicious"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_command_suspicious"
DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_renamed"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_renamed"
DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_reversed"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_reversed"
DEBUG:lib.cuckoo.core.plugins:Running signature "powershell_variable_obfuscation"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "powershell_variable_obfuscation"
DEBUG:lib.cuckoo.core.plugins:Running signature "punch_plus_plus_pcres"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "punch_plus_plus_pcres"
DEBUG:lib.cuckoo.core.plugins:Running signature "prevents_safeboot"
2022-09-15 15:12:52,103 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "prevents_safeboot"
DEBUG:lib.cuckoo.core.plugins:Running signature "cmdline_process_discovery"
2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cmdline_process_discovery"
DEBUG:lib.cuckoo.core.plugins:Running signature "procmem_yara"
2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "procmem_yara"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "procmem_yara"
2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "procmem_yara"
DEBUG:lib.cuckoo.core.plugins:Running signature "cryptomix_mutexes"
2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "cryptomix_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "dharma_mutexes"
2022-09-15 15:12:52,104 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dharma_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_extensions"
2022-09-15 15:12:52,105 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_extensions"
DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_files"
2022-09-15 15:12:52,117 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "fonix_mutexes"
2022-09-15 15:12:52,141 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "fonix_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "gandcrab_mutexes"
2022-09-15 15:12:52,141 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "gandcrab_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "germanwiper_mutexes"
2022-09-15 15:12:52,142 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "germanwiper_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "medusalocker_mutexes"
2022-09-15 15:12:52,142 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "medusalocker_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "medusalocker_regkeys"
2022-09-15 15:12:52,142 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "medusalocker_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "nemty_mutexes"
2022-09-15 15:12:52,143 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "nemty_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "nemty_regkeys"
2022-09-15 15:12:52,144 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "nemty_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "pysa_mutexes"
2022-09-15 15:12:52,144 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "pysa_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_radamant"
2022-09-15 15:12:52,145 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_radamant"
DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_recyclebin"
2022-09-15 15:12:52,146 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_recyclebin"
DEBUG:lib.cuckoo.core.plugins:Running signature "revil_mutexes"
2022-09-15 15:12:52,146 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "revil_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "ransomware_revil_regkey"
2022-09-15 15:12:52,146 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ransomware_revil_regkey"
DEBUG:lib.cuckoo.core.plugins:Running signature "satan_mutexes"
2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "satan_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "snake_ransom_mutexes"
2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "snake_ransom_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "stop_ransom_mutexes"
2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stop_ransom_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "stop_ransomware_cmd"
2022-09-15 15:12:52,147 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stop_ransomware_cmd"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_beebus_mutexes"
2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_beebus_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "blacknet_mutexes"
2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "blacknet_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "blackrat_mutexes"
2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "blackrat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "crat_mutexes"
2022-09-15 15:12:52,148 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "crat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "dcrat_files"
2022-09-15 15:12:52,149 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dcrat_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "dcrat_mutexes"
2022-09-15 15:12:52,150 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dcrat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_fynloski_mutexes"
2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_fynloski_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "karagany_files"
2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "karagany_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "limerat_mutexes"
2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "limerat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "limerat_regkeys"
2022-09-15 15:12:52,151 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "limerat_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "lodarat_file_behavior"
2022-09-15 15:12:52,156 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "lodarat_file_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "modirat_behavior"
2022-09-15 15:12:52,156 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "modirat_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "njrat_regkeys"
2022-09-15 15:12:52,157 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "njrat_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "obliquerat_files"
2022-09-15 15:12:52,158 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "obliquerat_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "obliquerat_mutexes"
2022-09-15 15:12:52,159 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "obliquerat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "parallax_mutexes"
2022-09-15 15:12:52,159 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "parallax_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_pcclient"
2022-09-15 15:12:52,160 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_pcclient"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_plugx_mutexes"
2022-09-15 15:12:52,161 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_plugx_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_poisonivy_mutexes"
2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_poisonivy_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_quasar_mutexes"
2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_quasar_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "ratsnif_mutexes"
2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ratsnif_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_senna_mutexes"
2022-09-15 15:12:52,162 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_senna_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_spynet"
2022-09-15 15:12:52,163 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_spynet"
DEBUG:lib.cuckoo.core.plugins:Running signature "venomrat_mutexes"
2022-09-15 15:12:52,163 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "venomrat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "warzonerat_files"
2022-09-15 15:12:52,164 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "warzonerat_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "warzonerat_regkeys"
2022-09-15 15:12:52,165 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "warzonerat_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "xpertrat_files"
2022-09-15 15:12:52,168 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "xpertrat_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "xpertrat_mutexes"
2022-09-15 15:12:52,168 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "xpertrat_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "rat_xtreme_mutexes"
2022-09-15 15:12:52,169 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rat_xtreme_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "recon_checkip"
2022-09-15 15:12:52,169 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "recon_checkip"
DEBUG:lib.cuckoo.core.plugins:Running signature "recon_fingerprint"
2022-09-15 15:12:52,170 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "recon_fingerprint"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "recon_fingerprint"
2022-09-15 15:12:52,172 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "recon_fingerprint"
DEBUG:lib.cuckoo.core.plugins:Running signature "remcos_files"
2022-09-15 15:12:52,172 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "remcos_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "remcos_mutexes"
2022-09-15 15:12:52,173 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "remcos_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "remcos_regkeys"
2022-09-15 15:12:52,173 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "remcos_regkeys"
DEBUG:lib.cuckoo.core.plugins:Running signature "rdptcp_key"
2022-09-15 15:12:52,175 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "rdptcp_key"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_rdp_clip"
2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_rdp_clip"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_remote_desktop_session"
2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_remote_desktop_session"
DEBUG:lib.cuckoo.core.plugins:Running signature "removes_networking_icon"
2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_networking_icon"
DEBUG:lib.cuckoo.core.plugins:Running signature "removes_pinned_programs"
2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_pinned_programs"
DEBUG:lib.cuckoo.core.plugins:Running signature "removes_security_maintenance_icon"
2022-09-15 15:12:52,176 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_security_maintenance_icon"
DEBUG:lib.cuckoo.core.plugins:Running signature "removes_startmenu_defaults"
2022-09-15 15:12:52,177 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_startmenu_defaults"
DEBUG:lib.cuckoo.core.plugins:Running signature "removes_username_startmenu"
2022-09-15 15:12:52,177 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "removes_username_startmenu"
DEBUG:lib.cuckoo.core.plugins:Running signature "spicyhotpot_behavior"
2022-09-15 15:12:52,178 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spicyhotpot_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "sniffer_winpcap"
2022-09-15 15:12:52,179 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "sniffer_winpcap"
DEBUG:lib.cuckoo.core.plugins:Running signature "spreading_autoruninf"
2022-09-15 15:12:52,180 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "spreading_autoruninf"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_authenticode"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_authenticode"
DEBUG:lib.cuckoo.core.plugins:Running signature "invalid_authenticode_signature"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "invalid_authenticode_signature"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_dotnet_anomaly"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_dotnet_anomaly"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_java"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_java"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_pdf"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_pdf"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_pe_anomaly"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_pe_anomaly"
DEBUG:lib.cuckoo.core.plugins:Running signature "pe_compile_timestomping"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "pe_compile_timestomping"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_pe_pdbpath"
2022-09-15 15:12:52,181 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_pe_pdbpath"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_rat_config"
2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_rat_config"
DEBUG:lib.cuckoo.core.plugins:Running signature "static_versioninfo_anomaly"
2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "static_versioninfo_anomaly"
DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_hidden_extension"
2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_hidden_extension"
DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_hiddenreg"
2022-09-15 15:12:52,182 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_hiddenreg"
DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_hide_notifications"
2022-09-15 15:12:52,184 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_hide_notifications"
DEBUG:lib.cuckoo.core.plugins:Running signature "stealth_webhistory"
2022-09-15 15:12:52,185 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "stealth_webhistory"
DEBUG:lib.cuckoo.core.plugins:Running signature "suricata_alert"
2022-09-15 15:12:52,186 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suricata_alert"
DEBUG:lib.cuckoo.core.plugins:Running signature "sysinternals_psexec"
2022-09-15 15:12:52,186 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "sysinternals_psexec"
DEBUG:lib.cuckoo.core.plugins:Running signature "sysinternals_tools"
2022-09-15 15:12:52,187 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "sysinternals_tools"
DEBUG:lib.cuckoo.core.plugins:Running signature "tampers_etw"
2022-09-15 15:12:52,188 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "tampers_etw"
DEBUG:lib.cuckoo.core.plugins:Running signature "lsa_tampering"
2022-09-15 15:12:52,189 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "lsa_tampering"
DEBUG:lib.cuckoo.core.plugins:Running signature "tampers_powershell_logging"
2022-09-15 15:12:52,189 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "tampers_powershell_logging"
DEBUG:lib.cuckoo.core.plugins:Running signature "targeted_flame"
2022-09-15 15:12:52,190 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "targeted_flame"
DEBUG:lib.cuckoo.core.plugins:Running signature "territorial_disputes_sigs"
2022-09-15 15:12:52,191 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "territorial_disputes_sigs"
DEBUG:lib.cuckoo.core.plugins:Running signature "trickbot_mutex"
2022-09-15 15:12:52,495 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "trickbot_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "fleercivet_mutex"
2022-09-15 15:12:52,495 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "fleercivet_mutex"
DEBUG:lib.cuckoo.core.plugins:Running signature "lokibot_mutexes"
2022-09-15 15:12:52,496 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "lokibot_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "ursnif_behavior"
2022-09-15 15:12:52,496 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "ursnif_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "troldesh_behavior"
2022-09-15 15:12:52,497 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "troldesh_behavior"
DEBUG:lib.cuckoo.core.plugins:Running signature "upatre_files"
2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "upatre_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "upatre_files"
2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "upatre_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_adfind"
2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_adfind"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_ms_protocol"
2022-09-15 15:12:52,498 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_ms_protocol"
DEBUG:lib.cuckoo.core.plugins:Running signature "neshta_mutexes"
2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "neshta_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "renamer_mutexes"
2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "renamer_mutexes"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_devicetree_1"
2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_devicetree_1"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_handles_1"
2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_handles_1"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_ldrmodules_1"
2022-09-15 15:12:52,499 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_ldrmodules_1"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_ldrmodules_2"
2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_ldrmodules_2"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_malfind_1"
2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_malfind_1"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_malfind_2"
2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_malfind_2"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_modscan_1"
2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_modscan_1"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_svcscan_1"
2022-09-15 15:12:52,500 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_svcscan_1"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_svcscan_2"
2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_svcscan_2"
DEBUG:lib.cuckoo.core.plugins:Running signature "volatility_svcscan_3"
2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "volatility_svcscan_3"
DEBUG:lib.cuckoo.core.plugins:Running signature "owa_web_shell_files"
2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "owa_web_shell_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "web_shell_files"
2022-09-15 15:12:52,501 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "web_shell_files"
DEBUG:lib.cuckoo.core.plugins:Running signature "web_shell_processes"
2022-09-15 15:12:52,502 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "web_shell_processes"
DEBUG:lib.cuckoo.core.plugins:Running signature "whois_create"
2022-09-15 15:12:52,502 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "whois_create"
DEBUG:lib.cuckoo.core.plugins:Running signature "dotnet_csc_build"
2022-09-15 15:12:52,502 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "dotnet_csc_build"
DEBUG:lib.cuckoo.core.plugins:Running signature "multiple_explorer_instances"
2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "multiple_explorer_instances"
DEBUG:lib.cuckoo.core.plugins:Running signature "script_tool_executed"
2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "script_tool_executed"
DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_certutil_use"
2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_certutil_use"
DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_command_tools"
2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_command_tools"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_command_tools"
2022-09-15 15:12:52,503 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_command_tools"
DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_mpcmdrun_use"
2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_mpcmdrun_use"
DEBUG:lib.cuckoo.core.plugins:Running signature "suspicious_ping_use"
2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "suspicious_ping_use"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_ping_use"
2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_ping_use"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_powershell_copyitem"
2022-09-15 15:12:52,504 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_powershell_copyitem"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities"
2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "uses_windows_utilities"
2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "uses_windows_utilities"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_appcmd"
2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_appcmd"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_csvde_ldifde"
2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_csvde_ldifde"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_cipher"
2022-09-15 15:12:52,505 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_cipher"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_clickonce"
2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_clickonce"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_dsquery"
2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_dsquery"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_esentutl"
2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_esentutl"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_finger"
2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_finger"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_mode"
2022-09-15 15:12:52,506 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_mode"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_ntdsutil"
2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_ntdsutil"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_nltest"
2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_nltest"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_to_create_scheduled_task"
2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_to_create_scheduled_task"
DEBUG:lib.cuckoo.core.plugins:Running signature "uses_windows_utilities_xcopy"
2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "uses_windows_utilities_xcopy"
DEBUG:lib.cuckoo.core.plugins:Running signature "wmic_command_suspicious"
2022-09-15 15:12:52,507 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "wmic_command_suspicious"
DEBUG:lib.cuckoo.core.plugins:Running signature "scrcons_wmi_script_consumer"
2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "scrcons_wmi_script_consumer"
DEBUG:lib.cuckoo.core.plugins:Running signature "allaple_mutexes"
2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Running signature "allaple_mutexes"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "cape_detected_threat"
2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "cape_detected_threat"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "antidebug_setunhandledexceptionfilter"
2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "antidebug_setunhandledexceptionfilter"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "modify_proxy"
2022-09-15 15:12:52,508 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "modify_proxy"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "deletes_self"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "deletes_self"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "infostealer_bitcoin"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "infostealer_bitcoin"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "injection_rwx"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "injection_rwx"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "modify_desktop_wallpaper"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "modify_desktop_wallpaper"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_multiple_direct_ip_connections"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_multiple_direct_ip_connections"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_excessive_udp"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_excessive_udp"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "network_icmp"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "network_icmp"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "procmem_yara"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "procmem_yara"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "recon_fingerprint"
2022-09-15 15:12:52,509 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "recon_fingerprint"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_command_tools"
2022-09-15 15:12:52,510 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_command_tools"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "suspicious_ping_use"
2022-09-15 15:12:52,510 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "suspicious_ping_use"
DEBUG:lib.cuckoo.core.plugins:Analysis matched signature "uses_windows_utilities"
2022-09-15 15:12:52,510 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Analysis matched signature "uses_windows_utilities"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "BinGraph"
2022-09-15 15:12:54,053 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "BinGraph"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "MITRE_TTPS"
2022-09-15 15:12:54,053 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "MITRE_TTPS"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "PCAP2CERT"
2022-09-15 15:12:54,053 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "PCAP2CERT"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "ReportHTML"
2022-09-15 15:12:54,097 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "ReportHTML"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "SubmitCAPE"
2022-09-15 15:12:56,039 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "SubmitCAPE"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "JsonDump"
2022-09-15 15:12:56,052 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "JsonDump"
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "MongoDB"
2022-09-15 15:12:56,254 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "MongoDB"
DEBUG:modules.reporting.mongodb:Deleted previous MongoDB data for Task 28
2022-09-15 15:12:56,883 [Task 28] [modules.reporting.mongodb] DEBUG: Deleted previous MongoDB data for Task 28
DEBUG:lib.cuckoo.core.plugins:Executing reporting module "RunStatistics"
2022-09-15 15:12:57,228 [Task 28] [lib.cuckoo.core.plugins] DEBUG: Executing reporting module "RunStatistics"
DEBUG:modules.reporting.runstatistics:Run statistics sucessed!
2022-09-15 15:12:57,251 [Task 28] [modules.reporting.runstatistics] DEBUG: Run statistics sucessed!
DEBUG:root:Finished processing task
2022-09-15 15:12:57,260 [Task 28] [root] DEBUG: Finished processing task
i don't have time to test it right now, i will keep this open till i have some spare time but i doubt that it will be this week
do you have enabled memory analysis in conf/process.conf
and modules inside of the conf/memory.conf
. but just with having it enabled in process.conf i see memory tab
so im not sure what is wrong on your side
with pslist enabled, i won't post the whole screen, but you can see that it shows me pslist
correctly
yes, it worked after a reboot. thanks alot
you don't need to reboot, you just need to restart cape-processor service when you change any processing/reporting services
About accounts on capesandbox.com
This is opensource and you getting free support so be friendly!
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
Please describe the behavior you are expecting. If your samples(x64) stuck in pending ensure that you set tags=x64 in hypervisor conf for x64 vms
I saw that there are several HTML files in CAPEv2/web/templates/analysis/memory which should display information about the memory dump e.g. pslist, privs, etc. I have enabled memory dump and the analyses results include the "memory.dmp" file. I expect there to be a tab for memory, just like how there are tabs for behavioral and network analysis...
Current Behavior
What is the current behavior?
I can't seem to find the memory tab in the analysis page:
How do I enable the memory HTML pages?