Analyzer Log
2025-12-03 22:34:39,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpwoh6zt
2025-12-03 22:34:39,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\UcvJjcWgsDDDKpeOWpDHCsF
2025-12-03 22:34:39,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\JsiUXYNQAQJmBvZxNGmOvpnhFcebzL
2025-12-03 22:34:39,265 [analyzer] DEBUG: Started auxiliary module Curtain
2025-12-03 22:34:39,280 [analyzer] DEBUG: Started auxiliary module DbgView
2025-12-03 22:34:39,717 [analyzer] DEBUG: Started auxiliary module Disguise
2025-12-03 22:34:39,937 [analyzer] DEBUG: Loaded monitor into process with pid 500
2025-12-03 22:34:39,937 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-12-03 22:34:39,937 [analyzer] DEBUG: Started auxiliary module Human
2025-12-03 22:34:39,937 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-12-03 22:34:39,937 [analyzer] DEBUG: Started auxiliary module Reboot
2025-12-03 22:34:40,078 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-12-03 22:34:40,078 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-12-03 22:34:40,078 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-12-03 22:34:40,078 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-12-03 22:34:40,280 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\hurl-7.0.0-x86_64-pc-windows-msvc-installer.exe' with arguments '' and pid 2448
2025-12-03 22:34:40,483 [analyzer] DEBUG: Loaded monitor into process with pid 2448
2025-12-03 22:34:41,296 [analyzer] INFO: Added new file to list with pid 2448 and path C:\Users\Administrator\AppData\Local\Temp\nsp5F50.tmp\modern-header.bmp
2025-12-03 22:34:41,328 [analyzer] INFO: Added new file to list with pid 2448 and path C:\Users\Administrator\AppData\Local\Temp\nsp5F50.tmp\modern-wizard.bmp
2025-12-03 22:34:41,358 [analyzer] INFO: Added new file to list with pid 2448 and path C:\Users\Administrator\AppData\Local\Temp\nsp5F50.tmp\nsDialogs.dll
2025-12-03 22:35:36,374 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-12-03 22:35:36,576 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2448.
2025-12-03 22:35:36,888 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-12-03 22:35:36,904 [lib.api.process] INFO: Successfully terminated process with pid 2448.
2025-12-03 22:35:36,936 [analyzer] INFO: Analysis completed.
Cuckoo Log
2025-12-03 23:34:44,556 [cuckoo.core.scheduler] INFO: Task #7212569: acquired machine win7x643 (label=win7x643)
2025-12-03 23:34:44,557 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.203 for task #7212569
2025-12-03 23:34:44,884 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 303047 (interface=vboxnet0, host=192.168.168.203)
2025-12-03 23:34:46,383 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x643
2025-12-03 23:34:47,456 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x643 to vmcloak
2025-12-03 23:34:58,547 [cuckoo.core.guest] INFO: Starting analysis #7212569 on guest (id=win7x643, ip=192.168.168.203)
2025-12-03 23:34:59,553 [cuckoo.core.guest] DEBUG: win7x643: not ready yet
2025-12-03 23:35:04,579 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x643, ip=192.168.168.203)
2025-12-03 23:35:04,648 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x643, ip=192.168.168.203, monitor=latest, size=6660546)
2025-12-03 23:35:06,044 [cuckoo.core.resultserver] DEBUG: Task #7212569: live log analysis.log initialized.
2025-12-03 23:35:06,931 [cuckoo.core.resultserver] DEBUG: Task #7212569 is sending a BSON stream
2025-12-03 23:35:07,448 [cuckoo.core.resultserver] DEBUG: Task #7212569 is sending a BSON stream
2025-12-03 23:35:08,242 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'shots/0001.jpg'
2025-12-03 23:35:08,270 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 133506
2025-12-03 23:35:08,295 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'files/e3b0c44298fc1c14_nsf5F11.tmp'
2025-12-03 23:35:08,297 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 0
2025-12-03 23:35:09,374 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'shots/0002.jpg'
2025-12-03 23:35:09,384 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 136215
2025-12-03 23:35:20,578 [cuckoo.core.guest] DEBUG: win7x643: analysis #7212569 still processing
2025-12-03 23:35:35,658 [cuckoo.core.guest] DEBUG: win7x643: analysis #7212569 still processing
2025-12-03 23:35:36,771 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'curtain/1764797736.76.curtain.log'
2025-12-03 23:35:36,774 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 36
2025-12-03 23:35:36,895 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'sysmon/1764797736.89.sysmon.xml'
2025-12-03 23:35:36,900 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 141648
2025-12-03 23:35:36,908 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'files/3ad2dc318056d0a2_modern-wizard.bmp'
2025-12-03 23:35:36,912 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 26494
2025-12-03 23:35:36,918 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'files/b2699fdfdab6a018_nsdialogs.dll'
2025-12-03 23:35:36,920 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 9728
2025-12-03 23:35:36,931 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'files/79e58281a27f8a4a_modern-header.bmp'
2025-12-03 23:35:36,937 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 645302
2025-12-03 23:35:37,340 [cuckoo.core.resultserver] DEBUG: Task #7212569: File upload for 'shots/0003.jpg'
2025-12-03 23:35:37,349 [cuckoo.core.resultserver] DEBUG: Task #7212569 uploaded file length: 133505
2025-12-03 23:35:37,365 [cuckoo.core.resultserver] DEBUG: Task #7212569 had connection reset for <Context for LOG>
2025-12-03 23:35:38,670 [cuckoo.core.guest] INFO: win7x643: analysis completed successfully
2025-12-03 23:35:38,680 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-12-03 23:35:38,705 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-12-03 23:35:39,900 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x643 to path /srv/cuckoo/cwd/storage/analyses/7212569/memory.dmp
2025-12-03 23:35:39,902 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x643
2025-12-03 23:35:48,582 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.203 for task #7212569
2025-12-03 23:35:48,937 [cuckoo.core.scheduler] DEBUG: Released database task #7212569
2025-12-03 23:35:48,955 [cuckoo.core.scheduler] INFO: Task #7212569: analysis procedure completed
