[prev in list] [next in list] [prev in thread] [next in thread]
List: cuckoo
Subject: Re: [cuckoo] Fwd: Screenshot.py Attribute Error
From: Charlie M <compactmidget () gmail ! com>
Date: 2014-05-14 18:56:32
Message-ID: CAHf-si6Oq+C+nrBGAR=UXGVic=j4itHzKF9J54t_1Guryq_Y8g () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
I don't know why I didn't think to check it sooner than I did, but iptables
is a monster. There was a trailing reject all that was stopping the guest
from communicating with the results server. Working like a charm now!
Thanks all for the help!
On Wed, May 14, 2014 at 11:03 AM, Charlie M <compactmidget@gmail.com> wrote=
:
> So doing a 'tcpdump -i vboxnet0 port 2042' during an analysis yielded
> something interesting. At the start of the analysis, data is being sent
> from the guest to host. About a quarter of the way through execution (jus=
t
> a couple seconds before the attribute error is barfed), all communication
> to port 2042 stops. Thoughts?
>
>
> On Tue, May 13, 2014 at 3:09 PM, Charlie M <compactmidget@gmail.com>wrote=
:
>
>> Again, thank you all for your help!
>>
>> I installed a 32-bit Win7 guest with UAC disabled (networking is good). =
I
>> am still only getting static analysis. I also noticed that I do not have=
a
>> analysis.log file for any runs in storage/analysis/. Any pointers on whe=
re
>> to look?
>>
>>
>> On Mon, May 12, 2014 at 7:50 AM, Charlie M <compactmidget@gmail.com>wrot=
e:
>>
>>> Sweet, thank you all for the help. I'll get a 32-bit Win7 on there and
>>> see how it goes. As a side note, is there anywhere in the docs that men=
tion
>>> that 64-bit isn't supported? I could have sworn I read the docs cover t=
o
>>> cover and I don't remember seeing it.
>>>
>>>
>>> On Fri, May 9, 2014 at 7:10 PM, Claudio <claudio@shadowserver.org>wrote=
:
>>>
>>>> Yes, we don't support 64bit at all yet.
>>>>
>>>> On 05/09/2014 09:22 PM, Charlie M wrote:
>>>> > So I have been trying to build to vm from the ground up again. With
>>>> > little luck. i vaguely remember hearing that cuckoo either doesn't
>>>> > support or has a tough time with 64-bit OS's (which I am running
>>>> 64-bit
>>>> > Win7). Might that be the problem?
>>>> >
>>>> >
>>>> > On Mon, May 5, 2014 at 11:50 AM, Charlie M <compactmidget@gmail.com
>>>> > <mailto:compactmidget@gmail.com>> wrote:
>>>> >
>>>> > Here is the log from the host: http://pastebin.com/AHbfYvwG
>>>> >
>>>> > The attribute error doesn't show up in the host log for some
>>>> reason.
>>>> > But is displayed inside the vm's agent.py script.
>>>> >
>>>> >
>>>> > On Mon, May 5, 2014 at 11:33 AM, Claudio <
>>>> claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>> wrote:
>>>> >
>>>> > Run Cuckoo in --debug and provide complete logs of one
>>>> analysis.
>>>> >
>>>> > On 05/05/2014 06:33 PM, Charlie M wrote:
>>>> > > VirtualBox with host-only. Iptable rules are also in place
>>>> to
>>>> > allow
>>>> > > access to the internet.
>>>> > >
>>>> > >
>>>> > > On Mon, May 5, 2014 at 10:57 AM, Claudio
>>>> > <claudio@shadowserver.org <mailto:claudio@shadowserver.org>
>>>> > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>>> wrote:
>>>> > >
>>>> > > What virtualization software are you using and which
>>>> > networking model?
>>>> > >
>>>> > > On 05/05/2014 05:18 PM, Charlie M wrote:
>>>> > > > So I am not sure where the connectivity is dropping.=
I
>>>> > can ping both
>>>> > > > ways and even SSH from guest to host via putty. I al=
so
>>>> > checked to
>>>> > > see if
>>>> > > > port 2024 is reachable from the guest to host and it
>>>> is.
>>>> > Any thing
>>>> > > else
>>>> > > > I could check?
>>>> > > >
>>>> > > > Thank you guys for the help thus far. I really
>>>> > appreciate it.
>>>> > > >
>>>> > > >
>>>> > > > On Mon, May 5, 2014 at 8:57 AM, Thorsten Sick
>>>> > > <thorsten.sick@avira.com <mailto:
>>>> thorsten.sick@avira.com>
>>>> > <mailto:thorsten.sick@avira.com <mailto:
>>>> thorsten.sick@avira.com>>
>>>> > > > <mailto:thorsten.sick@avira.com
>>>> > <mailto:thorsten.sick@avira.com> <mailto:
>>>> thorsten.sick@avira.com
>>>> > <mailto:thorsten.sick@avira.com>>>>
>>>> > > wrote:
>>>> > > >
>>>> > > > Hi
>>>> > > >
>>>> > > > All this information does not require the analys=
is
>>>> > tools in
>>>> > > the VM or
>>>> > > > communication between guest and host.
>>>> > > >
>>>> > > > Volatility is memory dump from the outside
>>>> > > > Static + strings do not require behaviour analys=
is
>>>> > at all
>>>> > > > and network conenction is sniffing on the host
>>>> > > >
>>>> > > > The tricky part setting up cuckoo is communicati=
on
>>>> > between
>>>> > > guest and
>>>> > > > host. You should check that.
>>>> > > >
>>>> > > > Good luck
>>>> > > > Thorsten Sick
>>>> > > >
>>>> > > > On 05.05.2014 15:52, Charlie M wrote:
>>>> > > > > I am getting some data back though: memory dum=
p
>>>> > analysis from
>>>> > > > volatility,
>>>> > > > > static analysis, strings, network connections.
>>>> > > > >
>>>> > > > >
>>>> > > > > On Mon, May 5, 2014 at 7:41 AM, Claudio
>>>> > > <claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>
>>>> > <mailto:claudio@shadowserver.org <mailto:
>>>> claudio@shadowserver.org>>
>>>> > > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>
>>>> > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>>>> wrote:
>>>> > > > >
>>>> > > > >> Which means that nothing is working.
>>>> > > > >>
>>>> > > > >> On 05/05/2014 02:41 PM, Charlie M wrote:
>>>> > > > >>> Reports are generating fine as far as I can
>>>> > tell. The only
>>>> > > > things that I
>>>> > > > >>> have not ever seen any data on are dropped
>>>> files
>>>> > and the
>>>> > > summary
>>>> > > > >>> sections for files, registry keys, and
>>>> mutexes.
>>>> > > > >>>
>>>> > > > >>>
>>>> > > > >>> On Fri, May 2, 2014 at 4:03 PM, Claudio
>>>> > > > <claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>
>>>> > <mailto:claudio@shadowserver.org <mailto:
>>>> claudio@shadowserver.org>>
>>>> > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>
>>>> > <mailto:claudio@shadowserver.org <mailto:
>>>> claudio@shadowserver.org>>>
>>>> > > > >>> <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>
>>>> > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>>
>>>> > > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>
>>>> > > <mailto:claudio@shadowserver.org
>>>> > <mailto:claudio@shadowserver.org>>>>> wrote:
>>>> > > > >>>
>>>> > > > >>> No, it means that it couldn't establish =
a
>>>> > connection
>>>> > > to the
>>>> > > > >> ResultServer
>>>> > > > >>> on the host machine for some reason.
>>>> > > > >>> Are all the other results (behavior logs=
,
>>>> > dropped
>>>> > > files, etc.)
>>>> > > > >> retrieved
>>>> > > > >>> correctly and are the reports generated?
>>>> > > > >>>
>>>> > > > >>> On 05/02/2014 09:41 PM, Robert Haist
>>>> wrote:
>>>> > > > >>> > Hey,
>>>> > > > >>> >
>>>> > > > >>> > seems like the data to send is not
>>>> available.
>>>> > > > >>> >
>>>> > > > >>> > Did you make sure to install PIL in th=
e
>>>> > cuckoo machines?
>>>> > > > >>> > ->
>>>> http://www.pythonware.com/products/pil/
>>>> > > > >>> >
>>>> > > > >>> > regards,
>>>> > > > >>> >
>>>> > > > >>> > Robert Haist
>>>> > > > >>> >
>>>> > > > >>> > Am 02.05.14 21:13, schrieb Charlie M:
>>>> > > > >>> >> Hello,
>>>> > > > >>> >>
>>>> > > > >>> >> I am having some trouble on getting
>>>> > cuckoo's screenshot
>>>> > > > >>> functionality to
>>>> > > > >>> >> work. I have went for help on the
>>>> > community page, but
>>>> > > > haven't had
>>>> > > > >>> much
>>>> > > > >>> >> love. Here is the topic thread if you
>>>> are
>>>> > > > >>> >> interested:
>>>> > > > >>>
>>>> > > > >>
>>>> > > >
>>>> > >
>>>> >
>>>> http://community.cuckoosandbox.org/posts/show/screenshotpy-attribute-e=
rror/
>>>> > > > >>> >>
>>>> > > > >>> >> I am not getting any screenshots from
>>>> my
>>>> > analyses.
>>>> > > > >>> >>
>>>> > > > >>> >> Python inside of my guest/analysis vm
>>>> is
>>>> > throwing this
>>>> > > > out during
>>>> > > > >> an
>>>> > > > >>> >> analysis:
>>>> > http://pastebin.com/QegwhzsP.Which I think is
>>>> > > > why I am
>>>> > > > >> not
>>>> > > > >>> >> getting screenshots.
>>>> > > > >>> >>
>>>> > > > >>> >> Networking is fine between the host a=
nd
>>>> > guest: pings go
>>>> > > > both ways
>>>> > > > >> and
>>>> > > > >>> >> guest has access to the internet as
>>>> well.
>>>> > I even used
>>>> > > > winscp to
>>>> > > > >>> pull the
>>>> > > > >>> >> updated agent.py after I upgraded to
>>>> > Cuckoo 1.1.
>>>> > > > Configurations
>>>> > > > >> look
>>>> > > > >>> >> solid as far as I can tell. I have ra=
n
>>>> > out of ideas for
>>>> > > > >>> troubleshooting
>>>> > > > >>> >> this.
>>>> > > > >>> >>
>>>> > > > >>> >> Thoughts?
>>>> > > > >>> >>
>>>> > > > >>> >> Thanks for any help in advance for th=
e
>>>> > help. I greatly
>>>> > > > appreciate
>>>> > > > >> it.
>>>> > > > >>> >>
>>>> > > > >>> >> -cm
>>>> > > > >>> >>
>>>> > > > >>> >>
>>>> > > > >>> >>
>>>> > > > >>> >>
>>>> > _______________________________________________
>>>> > > > >>> >> cuckoo mailing list
>>>> > > > >>> >> cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>>
>>>> > > > >>> >>
>>>> > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > > >>> >>
>>>> > > > >>> >
>>>> > _______________________________________________
>>>> > > > >>> > cuckoo mailing list
>>>> > > > >>> > cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>>
>>>> > > > >>> >
>>>> > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > > >>> >
>>>> > > > >>>
>>>> > > > >>>
>>>> _______________________________________________
>>>> > > > >>> cuckoo mailing list
>>>> > > > >>> cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>>
>>>> > > > >>>
>>>> > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > > >>>
>>>> > > > >>>
>>>> > > > >>>
>>>> > > > >>>
>>>> > > > >>>
>>>> _______________________________________________
>>>> > > > >>> cuckoo mailing list
>>>> > > > >>> cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > > >>>
>>>> https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > > >>>
>>>> > > > >>
>>>> > > > >> _____________________________________________=
__
>>>> > > > >> cuckoo mailing list
>>>> > > > >> cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > > >>
>>>> https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > > >>
>>>> > > > >
>>>> > > > >
>>>> > > > >
>>>> > > > > ______________________________________________=
_
>>>> > > > > cuckoo mailing list
>>>> > > > > cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > > >
>>>> https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > > >
>>>> > > >
>>>> > > >
>>>> > > > --
>>>> > > > Thorsten Sick
>>>> > > >
>>>> > > > Research
>>>> > > >
>>>> > > > Direct: +49 7542-500 4252
>>>> > <tel:%2B49%207542-500%204252> <tel:%2B49%207542-500%204252>
>>>> > > <tel:%2B49%207542-500%204252>
>>>> > > >
>>>> > > > Email: thorsten.sick@avira.com
>>>> > <mailto:thorsten.sick@avira.com>
>>>> > > <mailto:thorsten.sick@avira.com
>>>> > <mailto:thorsten.sick@avira.com>>
>>>> > <mailto:thorsten.sick@avira.com <mailto:
>>>> thorsten.sick@avira.com>
>>>> > > <mailto:thorsten.sick@avira.com
>>>> > <mailto:thorsten.sick@avira.com>>>
>>>> > > >
>>>> > > > --
>>>> > > > Avira Operations GmbH & Co. KG
>>>> > > > Kaplaneiweg 1 | 88069 Tettnang | Deutschland /
>>>> Germany
>>>> > > > Telefon / Telephone: +49 7542-500 0
>>>> > <tel:%2B49%207542-500%200> <tel:%2B49%207542-500%200>
>>>> > > <tel:%2B49%207542-500%200>
>>>> > > > Telefax / Facsimile: +49 7542-500 3000
>>>> > <tel:%2B49%207542-500%203000>
>>>> > > <tel:%2B49%207542-500%203000>
>>>> <tel:%2B49%207542-500%203000>
>>>> > > >
>>>> > > > Registergericht: Amtsgericht Ulm, HRA 722586 |
>>>> > USt.-IdNr.: DE
>>>> > > > 815289569 | Pers. haftende Gesellschafterin: Avi=
ra
>>>> > OP GmbH |
>>>> > > > Firmensitz: Tettnang | Registergericht:
>>>> Amtsgericht
>>>> > Ulm, HRB
>>>> > > 726712
>>>> > > > | Gesch=C3=A4ftsf=C3=BChrer: Travis Witteveen
>>>> > > >
>>>> > > > Commercial Register: Amtsgericht Ulm, HRA 722586=
|
>>>> > VAT-ID: DE
>>>> > > > 815289569 | Personally Liable Partner: Avira OP
>>>> GmbH |
>>>> > > Headquarters:
>>>> > > > Tettnang | Commercial Register: Amtsgericht Ulm,
>>>> HRB
>>>> > 726712 |
>>>> > > Chief
>>>> > > > Executive Officer (CEO): Travis Witteveen
>>>> > > > _______________________________________________
>>>> > > > cuckoo mailing list
>>>> > > > cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>>
>>>> > > >
>>>> https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > >
>>>> > > >
>>>> > > >
>>>> > > >
>>>> > > > _______________________________________________
>>>> > > > cuckoo mailing list
>>>> > > > cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > > >
>>>> > >
>>>> > > _______________________________________________
>>>> > > cuckoo mailing list
>>>> > > cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>
>>>> > <mailto:cuckoo@public.honeynet.org
>>>> > <mailto:cuckoo@public.honeynet.org>>
>>>> > > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > >
>>>> > >
>>>> > >
>>>> > >
>>>> > > _______________________________________________
>>>> > > cuckoo mailing list
>>>> > > cuckoo@public.honeynet.org <mailto:
>>>> cuckoo@public.honeynet.org>
>>>> > > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> > >
>>>> >
>>>> > _______________________________________________
>>>> > cuckoo mailing list
>>>> > cuckoo@public.honeynet.org <mailto:cuckoo@public.honeynet.or=
g
>>>> >
>>>> > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> >
>>>> >
>>>> >
>>>> >
>>>> >
>>>> > _______________________________________________
>>>> > cuckoo mailing list
>>>> > cuckoo@public.honeynet.org
>>>> > https://public.honeynet.org/mailman/listinfo/cuckoo
>>>> >
>>>>
>>>> _______________________________________________
>>>> cuckoo mailing list
>>>> cuckoo@public.honeynet.org
>>>> https://public.honeynet.org/mailman/listinfo/cuckoo
>>>>
>>>
>>>
>>
>
[Attachment #5 (text/html)]
<div dir="ltr">I don't know why I didn't think to check it sooner than I did, \
but iptables is a monster. There was a trailing reject all that was stopping the \
guest from communicating with the results server. Working like a charm now!<div> \
<br></div><div>Thanks all for the help!</div></div><div \
class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 14, 2014 at 11:03 \
AM, Charlie M <span dir="ltr"><<a href="mailto:compactmidget@gmail.com" \
target="_blank">compactmidget@gmail.com</a>></span> wrote:<br> <blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr">So doing a 'tcpdump -i vboxnet0 port \
2042' during an analysis yielded something interesting. At the start of the \
analysis, data is being sent from the guest to host. About a quarter of the way \
through execution (just a couple seconds before the attribute error is barfed), all \
communication to port 2042 stops. Thoughts?</div> <div class="HOEnZb"><div \
class="h5"> <div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 13, \
2014 at 3:09 PM, Charlie M <span dir="ltr"><<a \
href="mailto:compactmidget@gmail.com" \
target="_blank">compactmidget@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr">Again, thank you all for your help! \
<div><br></div><div>I installed a 32-bit Win7 guest with UAC disabled (networking is \
good). I am still only getting static analysis. I also noticed that I do not have a \
analysis.log file for any runs in storage/analysis/. Any pointers on where to \
look?<br>
</div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On \
Mon, May 12, 2014 at 7:50 AM, Charlie M <span dir="ltr"><<a \
href="mailto:compactmidget@gmail.com" \
target="_blank">compactmidget@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr">Sweet, thank you all for the help. I'll \
get a 32-bit Win7 on there and see how it goes. As a side note, is there anywhere in \
the docs that mention that 64-bit isn't supported? I could have sworn I read the \
docs cover to cover and I don't remember seeing it.</div>
<div><div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 9, 2014 at 7:10 \
PM, Claudio <span dir="ltr"><<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex">Yes, we don't support 64bit at all yet.<br> <div><br>
On 05/09/2014 09:22 PM, Charlie M wrote:<br>
> So I have been trying to build to vm from the ground up again. With<br>
> little luck. i vaguely remember hearing that cuckoo either doesn't<br>
> support or has a tough time with 64-bit OS's (which I am running 64-bit<br>
> Win7). Might that be the problem?<br>
><br>
><br>
> On Mon, May 5, 2014 at 11:50 AM, Charlie M <<a \
href="mailto:compactmidget@gmail.com" target="_blank">compactmidget@gmail.com</a><br> \
</div><div>> <mailto:<a href="mailto:compactmidget@gmail.com" \
target="_blank">compactmidget@gmail.com</a>>> wrote:<br> ><br>
> Here is the log from the host: <a href="http://pastebin.com/AHbfYvwG" \
target="_blank">http://pastebin.com/AHbfYvwG</a><br> ><br>
> The attribute error doesn't show up in the host log for some \
reason.<br> > But is displayed inside the vm's agent.py script.<br>
><br>
><br>
> On Mon, May 5, 2014 at 11:33 AM, Claudio <<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> </div><div>> <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>> wrote:<br> ><br>
> Run Cuckoo in --debug and provide complete logs of one analysis.<br>
><br>
> On 05/05/2014 06:33 PM, Charlie M wrote:<br>
> > VirtualBox with host-only. Iptable rules are also in place \
to<br> > allow<br>
> > access to the internet.<br>
> ><br>
> ><br>
> > On Mon, May 5, 2014 at 10:57 AM, Claudio<br>
> <<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a> <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> </div><div>> > \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>>> wrote:<br> > \
><br> </div><div><div>> > What virtualization software are \
you using and which<br> > networking model?<br>
> ><br>
> > On 05/05/2014 05:18 PM, Charlie M wrote:<br>
> > > So I am not sure where the connectivity is dropping. \
I<br> > can ping both<br>
> > > ways and even SSH from guest to host via putty. I \
also<br> > checked to<br>
> > see if<br>
> > > port 2024 is reachable from the guest to host and it \
is.<br> > Any thing<br>
> > else<br>
> > > I could check?<br>
> > ><br>
> > > Thank you guys for the help thus far. I really<br>
> appreciate it.<br>
> > ><br>
> > ><br>
> > > On Mon, May 5, 2014 at 8:57 AM, Thorsten Sick<br>
> > <<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a> <mailto:<a \
href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>><br> > <mailto:<a \
href="mailto:thorsten.sick@avira.com" target="_blank">thorsten.sick@avira.com</a> \
<mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>>><br> > > \
> <mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a><br> > <mailto:<a \
href="mailto:thorsten.sick@avira.com" target="_blank">thorsten.sick@avira.com</a>> \
<mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a><br> > <mailto:<a \
href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>>>>><br> > > \
wrote:<br> > > ><br>
> > > Hi<br>
> > ><br>
> > > All this information does not require the \
analysis<br> > tools in<br>
> > the VM or<br>
> > > communication between guest and host.<br>
> > ><br>
> > > Volatility is memory dump from the outside<br>
> > > Static + strings do not require behaviour \
analysis<br> > at all<br>
> > > and network conenction is sniffing on the \
host<br> > > ><br>
> > > The tricky part setting up cuckoo is \
communication<br> > between<br>
> > guest and<br>
> > > host. You should check that.<br>
> > ><br>
> > > Good luck<br>
> > > Thorsten Sick<br>
> > ><br>
> > > On 05.05.2014 15:52, Charlie M wrote:<br>
> > > > I am getting some data back though: \
memory dump<br> > analysis from<br>
> > > volatility,<br>
> > > > static analysis, strings, network \
connections.<br> > > > ><br>
> > > ><br>
> > > > On Mon, May 5, 2014 at 7:41 AM, \
Claudio<br> > > <<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" target="_blank">claudio@shadowserver.org</a> \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>><br>
</div></div><div><div>> > > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> > > \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>>>> wrote:<br> > \
> > ><br> > > > >> Which \
means that nothing is working.<br> > > > \
>><br> > > > >> On 05/05/2014 02:41 PM, \
Charlie M wrote:<br> > > > >>> Reports are \
generating fine as far as I can<br> > tell. The only<br>
> > > things that I<br>
> > > >>> have not ever seen any data on \
are dropped files<br> > and the<br>
> > summary<br>
> > > >>> sections for files, registry \
keys, and mutexes.<br> > > > >>><br>
> > > >>><br>
> > > >>> On Fri, May 2, 2014 at 4:03 PM, \
Claudio<br> > > > <<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" target="_blank">claudio@shadowserver.org</a> \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>><br>
> > <mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" target="_blank">claudio@shadowserver.org</a> \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>>><br>
> > > >>> <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> > > \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>><br> > > \
> <mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>><br> > > \
<mailto:<a href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a><br> > <mailto:<a \
href="mailto:claudio@shadowserver.org" \
target="_blank">claudio@shadowserver.org</a>>>>>> wrote:<br> > \
> > >>><br> > > > \
>>> No, it means that it couldn't establish a<br> > \
connection<br> > > to the<br>
> > > >> ResultServer<br>
> > > >>> on the host machine for \
some reason.<br> > > > >>> Are all \
the other results (behavior logs,<br> > dropped<br>
> > files, etc.)<br>
> > > >> retrieved<br>
> > > >>> correctly and are the \
reports generated?<br> > > > >>><br>
> > > >>> On 05/02/2014 09:41 PM, \
Robert Haist wrote:<br> > > > >>> \
> Hey,<br> > > > >>> ><br>
> > > >>> > seems like the data to \
send is not available.<br> > > > >>> \
><br> > > > >>> > Did you make \
sure to install PIL in the<br> > cuckoo machines?<br>
> > > >>> > -> <a \
href="http://www.pythonware.com/products/pil/" \
target="_blank">http://www.pythonware.com/products/pil/</a><br> > > \
> >>> ><br> > > > \
>>> > regards,<br> > > > \
>>> ><br> > > > >>> \
> Robert Haist<br> > > > >>> \
><br> > > > >>> > Am 02.05.14 \
21:13, schrieb Charlie M:<br> > > > >>> \
>> Hello,<br> > > > >>> \
>><br> > > > >>> >> I am \
having some trouble on getting<br> > cuckoo's screenshot<br>
> > > >>> functionality to<br>
> > > >>> >> work. I have went \
for help on the<br> > community page, but<br>
> > > haven't had<br>
> > > >>> much<br>
> > > >>> >> love. Here is the \
topic thread if you are<br> > > > >>> \
>> interested:<br> > > > >>><br>
> > > >><br>
> > ><br>
> ><br>
> <a href="http://community.cuckoosandbox.org/posts/show/screenshotpy-attribute-error/" \
target="_blank">http://community.cuckoosandbox.org/posts/show/screenshotpy-attribute-error/</a><br>
> > > >>> >><br>
> > > >>> >> I am not getting \
any screenshots from my<br> > analyses.<br>
> > > >>> >><br>
> > > >>> >> Python inside of \
my guest/analysis vm is<br> > throwing this<br>
> > > out during<br>
> > > >> an<br>
> > > >>> >> analysis:<br>
> <a href="http://pastebin.com/QegwhzsP.Which" \
target="_blank">http://pastebin.com/QegwhzsP.Which</a> I think is<br> > \
> > why I am<br> > > > >> \
not<br> > > > >>> >> getting \
screenshots.<br> > > > >>> \
>><br> > > > >>> >> \
Networking is fine between the host and<br> > guest: pings go<br>
> > > both ways<br>
> > > >> and<br>
> > > >>> >> guest has access \
to the internet as well.<br> > I even used<br>
> > > winscp to<br>
> > > >>> pull the<br>
> > > >>> >> updated agent.py \
after I upgraded to<br> > Cuckoo 1.1.<br>
> > > Configurations<br>
> > > >> look<br>
> > > >>> >> solid as far as I \
can tell. I have ran<br> > out of ideas for<br>
> > > >>> troubleshooting<br>
> > > >>> >> this.<br>
> > > >>> >><br>
> > > >>> >> Thoughts?<br>
> > > >>> >><br>
> > > >>> >> Thanks for any \
help in advance for the<br> > help. I greatly<br>
> > > appreciate<br>
> > > >> it.<br>
> > > >>> >><br>
> > > >>> >> -cm<br>
> > > >>> >><br>
> > > >>> >><br>
> > > >>> >><br>
> > > >>> >><br>
> _______________________________________________<br>
> > > >>> >> cuckoo mailing \
list<br> > > > >>> >> <a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>>><br> > \
> > >>> >><br> > <a \
href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> > >>> >><br> > > \
> >>> ><br> > \
_______________________________________________<br> > > > \
>>> > cuckoo mailing list<br> > > > \
>>> > <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>>><br> > \
> > >>> ><br> > <a \
href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> > >>> ><br> > > > \
>>><br> > > > >>> \
_______________________________________________<br> > > > \
>>> cuckoo mailing list<br> > > > \
>>> <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>>><br> > \
> > >>><br> > <a \
href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> > >>><br> > > > \
>>><br> > > > >>><br>
> > > >>><br>
> > > >>> \
_______________________________________________<br> > > > \
>>> cuckoo mailing list<br> > > > \
>>> <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> >>> <a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> > >>><br> > > > \
>><br> > > > >> \
_______________________________________________<br> > > > \
>> cuckoo mailing list<br> > > > >> <a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> >> <a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> > >><br> > > > ><br>
> > > ><br>
> > > ><br>
> > > > \
_______________________________________________<br> > > > \
> cuckoo mailing list<br> > > > > <a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> > <a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> > ><br> > > ><br>
> > ><br>
</div></div><div>> > > --<br>
> > > Thorsten Sick<br>
> > ><br>
> > > Research<br>
> > ><br>
> > > Direct: <a href="tel:%2B49%207542-500%204252" \
value="+4975425004252" target="_blank">+49 7542-500 4252</a><br> > \
<tel:%2B49%207542-500%204252> <tel:%2B49%207542-500%204252><br> > \
> <tel:%2B49%207542-500%204252><br> > > \
><br> > > > Email: <a \
href="mailto:thorsten.sick@avira.com" target="_blank">thorsten.sick@avira.com</a><br> \
> <mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>><br> > > \
<mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a><br> > <mailto:<a \
href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>>><br> </div><div>> \
<mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a> <mailto:<a \
href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>><br>
> > <mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a><br> </div><div><div>> \
<mailto:<a href="mailto:thorsten.sick@avira.com" \
target="_blank">thorsten.sick@avira.com</a>>>><br> > > \
><br> > > > --<br>
> > > Avira Operations GmbH & Co. KG<br>
> > > Kaplaneiweg 1 | 88069 Tettnang | Deutschland / \
Germany<br> > > > Telefon / Telephone: <a \
href="tel:%2B49%207542-500%200" value="+4975425000" target="_blank">+49 7542-500 \
0</a><br> > <tel:%2B49%207542-500%200> \
<tel:%2B49%207542-500%200><br> > > \
<tel:%2B49%207542-500%200><br> > > > Telefax / \
Facsimile: <a href="tel:%2B49%207542-500%203000" value="+4975425003000" \
target="_blank">+49 7542-500 3000</a><br> > \
<tel:%2B49%207542-500%203000><br> > > \
<tel:%2B49%207542-500%203000> <tel:%2B49%207542-500%203000><br> > \
> ><br> > > > Registergericht: \
Amtsgericht Ulm, HRA 722586 |<br> > USt.-IdNr.: DE<br>
> > > 815289569 | Pers. haftende Gesellschafterin: \
Avira<br> > OP GmbH |<br>
> > > Firmensitz: Tettnang | Registergericht: \
Amtsgericht<br> > Ulm, HRB<br>
> > 726712<br>
> > > | Geschäftsführer: Travis Witteveen<br>
> > ><br>
> > > Commercial Register: Amtsgericht Ulm, HRA \
722586 |<br> > VAT-ID: DE<br>
> > > 815289569 | Personally Liable Partner: Avira \
OP GmbH |<br> > > Headquarters:<br>
> > > Tettnang | Commercial Register: Amtsgericht \
Ulm, HRB<br> > 726712 |<br>
> > Chief<br>
> > > Executive Officer (CEO): Travis Witteveen<br>
> > > \
_______________________________________________<br> > > > \
cuckoo mailing list<br> > > > <a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> </div></div><div>> \
> <mailto:<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>>><br> > > \
> <a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> ><br> > > ><br>
> > ><br>
> > ><br>
> > > _______________________________________________<br>
> > > cuckoo mailing list<br>
> > > <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
> <a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
> ><br> > ><br>
> > _______________________________________________<br>
> > cuckoo mailing list<br>
> > <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>>><br> > > \
<a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
><br> > ><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > cuckoo mailing list<br>
> > <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a> <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> </div><div><div>> \
> <a href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> > \
><br> ><br>
> _______________________________________________<br>
> cuckoo mailing list<br>
> <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a> <mailto:<a \
href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a>><br> > <a \
href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> ><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> cuckoo mailing list<br>
> <a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> > <a \
href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> ><br>
<br>
_______________________________________________<br>
cuckoo mailing list<br>
<a href="mailto:cuckoo@public.honeynet.org" \
target="_blank">cuckoo@public.honeynet.org</a><br> <a \
href="https://public.honeynet.org/mailman/listinfo/cuckoo" \
target="_blank">https://public.honeynet.org/mailman/listinfo/cuckoo</a><br> \
</div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
_______________________________________________
cuckoo mailing list
cuckoo@public.honeynet.org
https://public.honeynet.org/mailman/listinfo/cuckoo
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic