Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
loligang.arm7

Overview

General Information

Sample Name:loligang.arm7
Analysis ID:651258
MD5:288e8dabaa23476987b7b953beb1e319
SHA1:ac59052889d6282c6c86abb9118aff243d0b4ed5
SHA256:a509e3b17d1efefa74540e9e27570cb98f42999881baca6cd4942c1c5ed4a8fe
Infos:

Detection

Mirai
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:651258
Start date and time: 23/06/202217:55:202022-06-23 17:55:20 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 15s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:loligang.arm7
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal100.troj.linARM7@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/loligang.arm7
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
loligang.arm7SUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x1625c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x162cc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1633c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x163ac:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1641c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1668c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x166e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x16734:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x16788:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x167dc:$xo1: oMXKNNC\x0D\x17\x0C\x12
loligang.arm7Mirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
  • 0x15c38:$x1: POST /cdn-cgi/
  • 0x160dc:$s1: LCOGQGPTGP
loligang.arm7MAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
  • 0x15c38:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
loligang.arm7MAL_ARM_LNX_Mirai_Mar13_2022Detects new ARM Mirai variantMehmet Ali Kerimoglu a.k.a. CYB3RMX
  • 0x216a5:$attck1: attack.c
  • 0x216d9:$attck3: anti_gdb_entry
  • 0x216e8:$attck4: resolve_cnc_addr
  • 0x22289:$attck7: attack_get_opt_ip
loligang.arm7JoeSecurity_Mirai_5Yara detected MiraiJoe Security
    Click to see the 2 entries

    PCAP (Network Traffic)

    SourceRuleDescriptionAuthorStrings
    dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      6235.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x3a48:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3ac0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3b38:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3bb0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3c28:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3eb8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3f10:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3f68:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3fc0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x4018:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6229.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x3a48:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3ac0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3b38:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3bb0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3c28:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3eb8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3f10:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3f68:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3fc0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x4018:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6226.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x3a48:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3ac0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3b38:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3bb0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3c28:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3eb8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3f10:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3f68:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3fc0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x4018:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x1625c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x162cc:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1633c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x163ac:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1641c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1668c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x166e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x16734:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x16788:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x167dc:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
      • 0x15c38:$x1: POST /cdn-cgi/
      • 0x160dc:$s1: LCOGQGPTGP
      Click to see the 19 entries

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: loligang.arm7Avira: detected
      Multi AV Scanner detection for submitted file
      Source: loligang.arm7Virustotal: Detection: 63%Perma Link
      Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
      Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
      Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
      Source: global trafficTCP traffic: 192.168.2.23:45602 -> 139.59.109.181:1791
      Source: /tmp/loligang.arm7 (PID: 6228)Socket: 0.0.0.0::23
      Source: /tmp/loligang.arm7 (PID: 6228)Socket: 0.0.0.0::0
      Source: /tmp/loligang.arm7 (PID: 6228)Socket: 0.0.0.0::80
      Source: /tmp/loligang.arm7 (PID: 6228)Socket: 0.0.0.0::81
      Source: /tmp/loligang.arm7 (PID: 6228)Socket: 0.0.0.0::8443
      Source: /tmp/loligang.arm7 (PID: 6228)Socket: 0.0.0.0::9009
      Source: /tmp/loligang.arm7 (PID: 6234)Socket: 0.0.0.0::0
      Source: /tmp/loligang.arm7 (PID: 6234)Socket: 0.0.0.0::80
      Source: /tmp/loligang.arm7 (PID: 6234)Socket: 0.0.0.0::81
      Source: /tmp/loligang.arm7 (PID: 6234)Socket: 0.0.0.0::8443
      Source: /tmp/loligang.arm7 (PID: 6234)Socket: 0.0.0.0::9009
      Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
      Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
      Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
      Source: unknownTCP traffic detected without corresponding DNS query: 139.59.109.181
      Source: unknownTCP traffic detected without corresponding DNS query: 76.64.177.212
      Source: unknownTCP traffic detected without corresponding DNS query: 178.165.118.212
      Source: unknownTCP traffic detected without corresponding DNS query: 103.7.215.153
      Source: unknownTCP traffic detected without corresponding DNS query: 198.15.174.197
      Source: unknownTCP traffic detected without corresponding DNS query: 45.13.59.133
      Source: unknownTCP traffic detected without corresponding DNS query: 216.76.77.227
      Source: unknownTCP traffic detected without corresponding DNS query: 112.186.250.68
      Source: unknownTCP traffic detected without corresponding DNS query: 39.241.44.222
      Source: unknownTCP traffic detected without corresponding DNS query: 250.129.247.102
      Source: unknownTCP traffic detected without corresponding DNS query: 38.143.239.55
      Source: unknownTCP traffic detected without corresponding DNS query: 193.212.17.109
      Source: unknownTCP traffic detected without corresponding DNS query: 115.207.164.250
      Source: unknownTCP traffic detected without corresponding DNS query: 179.49.120.173
      Source: unknownTCP traffic detected without corresponding DNS query: 161.59.111.98
      Source: unknownTCP traffic detected without corresponding DNS query: 133.37.119.128
      Source: unknownTCP traffic detected without corresponding DNS query: 120.8.186.192
      Source: unknownTCP traffic detected without corresponding DNS query: 113.95.4.38
      Source: unknownTCP traffic detected without corresponding DNS query: 58.157.157.44
      Source: unknownTCP traffic detected without corresponding DNS query: 176.75.22.31
      Source: unknownTCP traffic detected without corresponding DNS query: 114.6.103.195
      Source: unknownTCP traffic detected without corresponding DNS query: 113.171.122.115
      Source: unknownTCP traffic detected without corresponding DNS query: 123.149.103.18
      Source: unknownTCP traffic detected without corresponding DNS query: 83.192.49.152
      Source: unknownTCP traffic detected without corresponding DNS query: 96.1.17.14
      Source: unknownTCP traffic detected without corresponding DNS query: 247.112.198.170
      Source: unknownTCP traffic detected without corresponding DNS query: 151.105.55.144
      Source: unknownTCP traffic detected without corresponding DNS query: 13.250.60.254
      Source: unknownTCP traffic detected without corresponding DNS query: 204.176.35.80
      Source: unknownTCP traffic detected without corresponding DNS query: 68.167.102.125
      Source: unknownTCP traffic detected without corresponding DNS query: 39.43.41.130
      Source: unknownTCP traffic detected without corresponding DNS query: 111.229.26.140
      Source: unknownTCP traffic detected without corresponding DNS query: 45.86.67.31
      Source: unknownTCP traffic detected without corresponding DNS query: 53.46.52.97
      Source: unknownTCP traffic detected without corresponding DNS query: 13.123.82.113
      Source: unknownTCP traffic detected without corresponding DNS query: 142.185.91.38
      Source: unknownTCP traffic detected without corresponding DNS query: 1.82.7.12
      Source: unknownTCP traffic detected without corresponding DNS query: 175.229.150.209
      Source: unknownTCP traffic detected without corresponding DNS query: 250.206.123.186
      Source: unknownTCP traffic detected without corresponding DNS query: 135.254.86.35
      Source: unknownTCP traffic detected without corresponding DNS query: 136.150.57.0
      Source: unknownTCP traffic detected without corresponding DNS query: 176.88.152.151
      Source: unknownTCP traffic detected without corresponding DNS query: 42.1.171.176
      Source: unknownTCP traffic detected without corresponding DNS query: 72.233.147.136
      Source: unknownTCP traffic detected without corresponding DNS query: 209.164.60.243
      Source: unknownTCP traffic detected without corresponding DNS query: 86.255.50.76
      Source: unknownTCP traffic detected without corresponding DNS query: 19.21.208.57
      Source: unknownTCP traffic detected without corresponding DNS query: 62.50.255.23

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: loligang.arm7, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: loligang.arm7, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Contains symbols with names commonly found in malware
      Source: ELF static info symbol of initial sampleName: attack.c
      Source: ELF static info symbol of initial sampleName: attack_app.c
      Source: ELF static info symbol of initial sampleName: attack_app_http
      Source: ELF static info symbol of initial sampleName: attack_get_opt_int
      Source: ELF static info symbol of initial sampleName: attack_get_opt_ip
      Source: ELF static info symbol of initial sampleName: attack_get_opt_str
      Source: ELF static info symbol of initial sampleName: attack_init
      Source: ELF static info symbol of initial sampleName: attack_method.c
      Source: ELF static info symbol of initial sampleName: attack_method_asyn
      Source: ELF static info symbol of initial sampleName: attack_method_greip
      Source: loligang.arm7, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: loligang.arm7, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: loligang.arm7, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: loligang.arm7, type: SAMPLEMatched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
      Source: 6235.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6229.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6226.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6228.1.00000000f2097c29.00000000b0e52cbf.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
      Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: loligang.arm7ELF static info symbol of initial sample: __gnu_unwind_execute
      Source: loligang.arm7ELF static info symbol of initial sample: scanner.c
      Source: loligang.arm7ELF static info symbol of initial sample: scanner_init
      Source: loligang.arm7ELF static info symbol of initial sample: scanner_pid
      Source: loligang.arm7ELF static info symbol of initial sample: scanner_rawpkt
      Source: /tmp/loligang.arm7 (PID: 6228)SIGKILL sent: pid: 936, result: successful
      Source: /tmp/loligang.arm7 (PID: 6234)SIGKILL sent: pid: 936, result: successful
      Source: /tmp/loligang.arm7 (PID: 6234)SIGKILL sent: pid: 6228, result: successful
      Source: /tmp/loligang.arm7 (PID: 6234)SIGKILL sent: pid: 759, result: successful
      Source: classification engineClassification label: mal100.troj.linARM7@0/0@0/0
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2033/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2033/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1582/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1582/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2275/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/6193/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1612/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1612/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1579/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1579/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1699/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1699/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1335/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1335/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1698/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1698/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2028/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2028/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1334/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1334/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1576/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1576/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2302/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/3236/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2025/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2025/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2146/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/910/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/912/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/912/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/912/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/759/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/759/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/759/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/6228/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/517/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2307/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/918/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/918/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/918/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1594/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1594/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2285/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2281/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1349/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1349/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1623/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1623/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/761/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/761/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/761/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1622/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1622/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/884/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/884/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/884/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1983/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1983/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2038/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2038/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1586/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1586/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1465/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1465/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1344/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1344/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1860/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1860/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1463/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1463/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2156/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/800/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/800/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/800/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/801/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/801/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/801/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1629/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1629/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1627/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1627/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1900/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1900/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/491/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/491/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/491/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2294/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2050/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/2050/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1877/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1877/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/772/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/772/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/772/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1633/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1633/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1599/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1599/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1632/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1632/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1477/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/1477/exe
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/774/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/774/fd
      Source: /tmp/loligang.arm7 (PID: 6234)File opened: /proc/774/exe
      Source: /tmp/loligang.arm7 (PID: 6226)Queries kernel information via 'uname':
      Source: loligang.arm7, 6226.1.000000007380f233.000000001ab6ca97.rw-.sdmp, loligang.arm7, 6228.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6229.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6235.1.000000007380f233.0000000050387bb9.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
      Source: loligang.arm7, 6226.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6228.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6229.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6235.1.0000000078068229.0000000079bc9c10.rw-.sdmpBinary or memory string: Wx86_64/usr/bin/qemu-arm/tmp/loligang.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/loligang.arm7
      Source: loligang.arm7, 6226.1.000000007380f233.000000001ab6ca97.rw-.sdmp, loligang.arm7, 6228.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6229.1.000000007380f233.0000000050387bb9.rw-.sdmp, loligang.arm7, 6235.1.000000007380f233.0000000050387bb9.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
      Source: loligang.arm7, 6226.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6228.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6229.1.0000000078068229.0000000079bc9c10.rw-.sdmp, loligang.arm7, 6235.1.0000000078068229.0000000079bc9c10.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

      Stealing of Sensitive Information

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: dump.pcap, type: PCAP
      Source: Yara matchFile source: loligang.arm7, type: SAMPLE
      Source: Yara matchFile source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: dump.pcap, type: PCAP
      Source: Yara matchFile source: loligang.arm7, type: SAMPLE
      Source: Yara matchFile source: 6229.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6235.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6228.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6226.1.0000000051d3e91b.00000000a87f4f70.r-x.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      Masquerading      		1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
      Encrypted Channel      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
      Non-Standard Port      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
      Application Layer Protocol      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 651258 Sample: loligang.arm7 Startdate: 23/06/2022 Architecture: LINUX Score: 100 22 80.101.159.152, 23 XS4ALL-NLAmsterdamNL Netherlands 2->22 24 69.1.28.16, 23 WOW-INTERNETUS United States 2->24 26 98 other IPs or domains 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Antivirus / Scanner detection for submitted sample 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 2 other signatures 2->34 8 loligang.arm7 2->8         started        signatures3 process4 process5 10 loligang.arm7 8->10         started        12 loligang.arm7 8->12         started        14 loligang.arm7 8->14         started        process6 16 loligang.arm7 10->16         started        18 loligang.arm7 10->18         started        20 loligang.arm7 10->20         started       

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      loligang.arm764%VirustotalBrowse
      loligang.arm7100%AviraLINUX/Mirai.bonb

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      108.209.42.12
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      249.72.134.178
      		unknownReserved
      		unknownunknownfalse
      179.93.255.153
      		unknownBrazil
      		26599TELEFONICABRASILSABRfalse
      152.129.200.6
      		unknownUnited States
      		6400CompaniaDominicanadeTelefonosSADOfalse
      100.200.156.97
      		unknownUnited States
      		21928T-MOBILE-AS21928USfalse
      156.39.96.180
      		unknownUnited States
      		21589CSJ-INTERNETUSfalse
      62.84.95.92
      		unknownLebanon
      		42334BBP-ASLBfalse
      150.191.202.16
      		unknownAustralia
      		132321NTG-ICT-AUNorthernTerritoryGovernmentAUfalse
      17.50.175.223
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      220.40.43.123
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      223.46.186.46
      		unknownKorea Republic of
      		9644SKTELECOM-NET-ASSKTelecomKRfalse
      36.130.2.0
      		unknownChina
      		56044CMNET-AS-LIAONINGChinaMobilecommunicationscorporationCfalse
      84.215.92.78
      		unknownNorway
      		41164GET-NOGETNorwayNOfalse
      218.137.233.136
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      207.10.72.56
      		unknownUnited States
      		7029WINDSTREAMUSfalse
      19.161.254.178
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      80.101.159.152
      		unknownNetherlands
      		3265XS4ALL-NLAmsterdamNLfalse
      57.116.96.6
      		unknownBelgium
      		51964ORANGE-BUSINESS-SERVICES-IPSN-ASNFRfalse
      155.92.17.198
      		unknownUnited States
      		11500MSOE-INTERNETUSfalse
      76.10.66.248
      		unknownUnited States
      		12042ENVENTISUSfalse
      77.80.94.60
      		unknownAustria
      		760UNIVIEUniversityofViennaAustriaATfalse
      220.91.9.73
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      185.217.102.182
      		unknownSaudi Arabia
      		61102INTERHOSTILfalse
      32.91.28.253
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      212.176.168.241
      		unknownRussian Federation
      		2854ROSPRINT-ASRUfalse
      117.38.197.2
      		unknownChina
      		4809CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarrfalse
      43.106.63.86
      		unknownJapan4249LILLY-ASUSfalse
      245.71.99.94
      		unknownReserved
      		unknownunknownfalse
      243.142.110.31
      		unknownReserved
      		unknownunknownfalse
      135.149.155.149
      		unknownSingapore
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      45.187.24.34
      		unknownunknown
      		269469GIGARTELECOMUNICACOESLTDAMEBRfalse
      73.111.243.164
      		unknownUnited States
      		7922COMCAST-7922USfalse
      95.237.75.31
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      65.162.11.142
      		unknownUnited States
      		27619AS-CUSTOMCRITICALUSfalse
      79.159.221.243
      		unknownSpain
      		3352TELEFONICA_DE_ESPANAESfalse
      120.80.214.216
      		unknownChina
      		17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
      75.159.81.118
      		unknownCanada
      		852ASN852CAfalse
      125.45.245.172
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      163.4.157.33
      		unknownUnited States
      		17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
      69.1.28.16
      		unknownUnited States
      		12083WOW-INTERNETUSfalse
      80.120.26.69
      		unknownAustria
      		8447TELEKOM-ATA1TelekomAustriaAGATfalse
      45.96.84.18
      		unknownEgypt
      		37069MOBINILEGfalse
      8.247.30.169
      		unknownUnited States
      		3356LEVEL3USfalse
      104.201.231.125
      		unknownUnited States
      		29848WCUUSfalse
      4.44.140.121
      		unknownUnited States
      		3356LEVEL3USfalse
      125.3.48.215
      		unknownJapan2510INFOWEBFUJITSULIMITEDJPfalse
      168.135.17.100
      		unknownUnited States
      		1221ASN-TELSTRATelstraCorporationLtdAUfalse
      112.145.92.69
      		unknownKorea Republic of
      		17858POWERVIS-AS-KRLGPOWERCOMMKRfalse
      86.254.193.203
      		unknownFrance
      		3215FranceTelecom-OrangeFRfalse
      57.72.60.255
      		unknownBelgium
      		4862EQUANT-ASIAOrangeBusinessASforAsiaHKfalse
      250.179.12.49
      		unknownReserved
      		unknownunknownfalse
      254.147.136.244
      		unknownReserved
      		unknownunknownfalse
      4.75.229.215
      		unknownUnited States
      		3356LEVEL3USfalse
      102.96.27.233
      		unknownMorocco
      		36925ASMediMAfalse
      250.205.235.127
      		unknownReserved
      		unknownunknownfalse
      200.151.131.224
      		unknownBrazil
      		7738TelemarNorteLesteSABRfalse
      243.34.7.68
      		unknownReserved
      		unknownunknownfalse
      60.115.35.127
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      247.102.38.115
      		unknownReserved
      		unknownunknownfalse
      2.42.145.12
      		unknownItaly
      		30722VODAFONE-IT-ASNITfalse
      96.41.60.153
      		unknownUnited States
      		20115CHARTER-20115USfalse
      213.237.247.85
      		unknownUnited Kingdom
      		5587ITILITY-LIMITEDInternetServiceProviderGBfalse
      180.176.28.64
      		unknownTaiwan; Republic of China (ROC)
      		38841KBRO-AS-TWkbroCOLtdTWfalse
      172.245.44.19
      		unknownUnited States
      		36352AS-COLOCROSSINGUSfalse
      146.250.99.97
      		unknownUnited States
      		8147ASERICYUSfalse
      247.145.128.41
      		unknownReserved
      		unknownunknownfalse
      36.138.16.86
      		unknownChina
      		56044CMNET-AS-LIAONINGChinaMobilecommunicationscorporationCfalse
      107.16.146.143
      		unknownUnited States
      		14654WAYPORTUSfalse
      113.87.217.175
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      221.106.90.119
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      150.219.43.200
      		unknownUnited States
      		10952ECU-ASUSfalse
      17.47.26.172
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      150.35.161.144
      		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
      19.190.239.77
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      216.62.171.70
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      178.202.21.58
      		unknownGermany
      		6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
      53.213.143.219
      		unknownGermany
      		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
      103.102.17.243
      		unknownTaiwan; Republic of China (ROC)
      		137015MOZILLA-AS-APMOZ2008CorporationTWfalse
      48.145.78.98
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      67.99.144.205
      		unknownUnited States
      		6977IAC-ASUSfalse
      201.165.161.115
      		unknownMexico
      		13999MegaCableSAdeCVMXfalse
      117.63.228.125
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      115.6.28.141
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      82.67.203.180
      		unknownFrance
      		12322PROXADFRfalse
      77.201.155.173
      		unknownFrance
      		15557LDCOMNETFRfalse
      119.194.46.22
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      133.225.201.186
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      247.14.4.34
      		unknownReserved
      		unknownunknownfalse
      12.51.172.250
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      154.89.133.233
      		unknownSeychelles
      		132839POWERLINE-AS-APPOWERLINEDATACENTERHKfalse
      114.68.147.207
      		unknownChina
      		23724CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporationfalse
      4.116.184.153
      		unknownUnited States
      		3356LEVEL3USfalse
      18.123.79.112
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      27.33.200.63
      		unknownAustralia
      		7545TPG-INTERNET-APTPGTelecomLimitedAUfalse
      218.8.158.16
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      197.198.22.236
      		unknownEgypt
      		36992ETISALAT-MISREGfalse
      65.94.27.27
      		unknownCanada
      		577BACOMCAfalse
      190.164.93.152
      		unknownChile
      		22047VTRBANDAANCHASACLfalse
      172.45.250.177
      		unknownUnited States
      		21928T-MOBILE-AS21928USfalse
      178.31.134.97
      		unknownSweden
      		2119TELENOR-NEXTELTelenorNorgeASNOfalse

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
      Entropy (8bit):5.994333873597081
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:loligang.arm7
      File size:145189
      MD5:288e8dabaa23476987b7b953beb1e319
      SHA1:ac59052889d6282c6c86abb9118aff243d0b4ed5
      SHA256:a509e3b17d1efefa74540e9e27570cb98f42999881baca6cd4942c1c5ed4a8fe
      SHA512:c03a3669eaff4b1deef603fe8795b0e4b70d86e916741fb458f924c47d7d18f1704ca12ffde878fa3c557373f662f9220ec283ecf3fa18b99cf6ad4380bb1be3
      SSDEEP:3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1QV:walgM69pe0QmlTvI8t9mrsplDKZUQQBU
      TLSH:16E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49
      File Content Preview:.ELF..............(.........4...........4. ...(........p@l..@...@...................................Xm..Xm...............p...p...p......x4...............p...p...p..................Q.td..................................-...L..................@-.,@...0....S

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:ARM
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x8194
      Flags:0x4000002
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:5
      Section Header Offset:118544
      Section Header Size:40
      Number of Section Headers:29
      Header String Table Index:26

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x80d40xd40x100x00x6AX004
      .textPROGBITS0x80f00xf00x15b380x00x6AX0016
      .finiPROGBITS0x1dc280x15c280x100x00x6AX004
      .rodataPROGBITS0x1dc380x15c380xff00x00x2A004
      .ARM.extabPROGBITS0x1ec280x16c280x180x00x2A004
      .ARM.exidxARM_EXIDX0x1ec400x16c400x1180x00x82AL204
      .eh_framePROGBITS0x270000x170000x40x00x3WA004
      .tbssNOBITS0x270040x170040x80x00x403WAT004
      .init_arrayINIT_ARRAY0x270040x170040x40x00x3WA004
      .fini_arrayFINI_ARRAY0x270080x170080x40x00x3WA004
      .jcrPROGBITS0x2700c0x1700c0x40x00x3WA004
      .gotPROGBITS0x270100x170100xa80x40x3WA004
      .dataPROGBITS0x270b80x170b80x1540x00x3WA004
      .bssNOBITS0x2720c0x1720c0x326c0x00x3WA004
      .commentPROGBITS0x00x1720c0x9160x00x0001
      .debug_arangesPROGBITS0x00x17b280xc00x00x0008
      .debug_pubnamesPROGBITS0x00x17be80x2130x00x0001
      .debug_infoPROGBITS0x00x17dfb0x1d230x00x0001
      .debug_abbrevPROGBITS0x00x19b1e0x6920x00x0001
      .debug_linePROGBITS0x00x1a1b00x9c70x00x0001
      .debug_framePROGBITS0x00x1ab780x2b80x00x0004
      .debug_strPROGBITS0x00x1ae300x8ca0x10x30MS001
      .debug_locPROGBITS0x00x1b6fa0x118f0x00x0001
      .debug_rangesPROGBITS0x00x1c8890x5580x00x0001
      .ARM.attributesARM_ATTRIBUTES0x00x1cde10x160x00x0001
      .shstrtabSTRTAB0x00x1cdf70x1170x00x0001
      .symtabSYMTAB0x00x1d3980x42400x100x0286074
      .strtabSTRTAB0x00x215d80x214d0x00x0001

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      EXIDX0x16c400x1ec400x1ec400x1180x1184.46570x4R 0x4.ARM.exidx
      LOAD0x00x80000x80000x16d580x16d586.09560x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
      LOAD0x170000x270000x270000x20c0x34782.70410x6RW 0x8000.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
      TLS0x170040x270040x270040x00x80.00000x4R 0x4.tbss
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

      Symbols

      NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
      .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      .symtab0x80d40SECTION<unknown>DEFAULT1
      .symtab0x80f00SECTION<unknown>DEFAULT2
      .symtab0x1dc280SECTION<unknown>DEFAULT3
      .symtab0x1dc380SECTION<unknown>DEFAULT4
      .symtab0x1ec280SECTION<unknown>DEFAULT5
      .symtab0x1ec400SECTION<unknown>DEFAULT6
      .symtab0x270000SECTION<unknown>DEFAULT7
      .symtab0x270040SECTION<unknown>DEFAULT8
      .symtab0x270040SECTION<unknown>DEFAULT9
      .symtab0x270080SECTION<unknown>DEFAULT10
      .symtab0x2700c0SECTION<unknown>DEFAULT11
      .symtab0x270100SECTION<unknown>DEFAULT12
      .symtab0x270b80SECTION<unknown>DEFAULT13
      .symtab0x2720c0SECTION<unknown>DEFAULT14
      .symtab0x00SECTION<unknown>DEFAULT15
      .symtab0x00SECTION<unknown>DEFAULT16
      .symtab0x00SECTION<unknown>DEFAULT17
      .symtab0x00SECTION<unknown>DEFAULT18
      .symtab0x00SECTION<unknown>DEFAULT19
      .symtab0x00SECTION<unknown>DEFAULT20
      .symtab0x00SECTION<unknown>DEFAULT21
      .symtab0x00SECTION<unknown>DEFAULT22
      .symtab0x00SECTION<unknown>DEFAULT23
      .symtab0x00SECTION<unknown>DEFAULT24
      .symtab0x00SECTION<unknown>DEFAULT25
      $a.symtab0x80d40NOTYPE<unknown>DEFAULT1
      $a.symtab0x1dc280NOTYPE<unknown>DEFAULT3
      $a.symtab0x80e00NOTYPE<unknown>DEFAULT1
      $a.symtab0x1dc340NOTYPE<unknown>DEFAULT3
      $a.symtab0x80f00NOTYPE<unknown>DEFAULT2
      $a.symtab0x81340NOTYPE<unknown>DEFAULT2
      $a.symtab0x81940NOTYPE<unknown>DEFAULT2
      $a.symtab0x81d00NOTYPE<unknown>DEFAULT2
      $a.symtab0x85240NOTYPE<unknown>DEFAULT2
      $a.symtab0x90500NOTYPE<unknown>DEFAULT2
      $a.symtab0xa1400NOTYPE<unknown>DEFAULT2
      $a.symtab0xa19c0NOTYPE<unknown>DEFAULT2
      $a.symtab0xa2980NOTYPE<unknown>DEFAULT2
      $a.symtab0xa4b40NOTYPE<unknown>DEFAULT2
      $a.symtab0xa5200NOTYPE<unknown>DEFAULT2
      $a.symtab0xa5900NOTYPE<unknown>DEFAULT2
      $a.symtab0xa9740NOTYPE<unknown>DEFAULT2
      $a.symtab0xb0200NOTYPE<unknown>DEFAULT2
      $a.symtab0xb6cc0NOTYPE<unknown>DEFAULT2
      $a.symtab0xbd780NOTYPE<unknown>DEFAULT2
      $a.symtab0xc4240NOTYPE<unknown>DEFAULT2
      $a.symtab0xcad00NOTYPE<unknown>DEFAULT2
      $a.symtab0xd17c0NOTYPE<unknown>DEFAULT2
      $a.symtab0xd8280NOTYPE<unknown>DEFAULT2
      $a.symtab0xde440NOTYPE<unknown>DEFAULT2
      $a.symtab0xe0e40NOTYPE<unknown>DEFAULT2
      $a.symtab0xe3840NOTYPE<unknown>DEFAULT2
      $a.symtab0xe7bc0NOTYPE<unknown>DEFAULT2
      $a.symtab0xe80c0NOTYPE<unknown>DEFAULT2
      $a.symtab0xe8b00NOTYPE<unknown>DEFAULT2
      $a.symtab0xee180NOTYPE<unknown>DEFAULT2
      $a.symtab0xfe200NOTYPE<unknown>DEFAULT2
      $a.symtab0x101a00NOTYPE<unknown>DEFAULT2
      $a.symtab0x101b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x102000NOTYPE<unknown>DEFAULT2
      $a.symtab0x102f00NOTYPE<unknown>DEFAULT2
      $a.symtab0x1098c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x109e80NOTYPE<unknown>DEFAULT2
      $a.symtab0x10a500NOTYPE<unknown>DEFAULT2
      $a.symtab0x10b2c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x10bf40NOTYPE<unknown>DEFAULT2
      $a.symtab0x10d540NOTYPE<unknown>DEFAULT2
      $a.symtab0x10e500NOTYPE<unknown>DEFAULT2
      $a.symtab0x130e80NOTYPE<unknown>DEFAULT2
      $a.symtab0x13b140NOTYPE<unknown>DEFAULT2
      $a.symtab0x13d300NOTYPE<unknown>DEFAULT2
      $a.symtab0x13d540NOTYPE<unknown>DEFAULT2
      $a.symtab0x13df40NOTYPE<unknown>DEFAULT2
      $a.symtab0x13e940NOTYPE<unknown>DEFAULT2
      $a.symtab0x14c5c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x14c840NOTYPE<unknown>DEFAULT2
      $a.symtab0x14ccc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x14cf00NOTYPE<unknown>DEFAULT2
      $a.symtab0x14d140NOTYPE<unknown>DEFAULT2
      $a.symtab0x14d800NOTYPE<unknown>DEFAULT2
      $a.symtab0x14ebc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x14f180NOTYPE<unknown>DEFAULT2
      $a.symtab0x14fac0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1503c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x150bc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x151500NOTYPE<unknown>DEFAULT2
      $a.symtab0x1524c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x153600NOTYPE<unknown>DEFAULT2
      $a.symtab0x154a40NOTYPE<unknown>DEFAULT2
      $a.symtab0x154b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x155500NOTYPE<unknown>DEFAULT2
      $a.symtab0x156440NOTYPE<unknown>DEFAULT2
      $a.symtab0x156580NOTYPE<unknown>DEFAULT2
      $a.symtab0x157380NOTYPE<unknown>DEFAULT2
      $a.symtab0x157700NOTYPE<unknown>DEFAULT2
      $a.symtab0x157b00NOTYPE<unknown>DEFAULT2
      $a.symtab0x157f40NOTYPE<unknown>DEFAULT2
      $a.symtab0x158780NOTYPE<unknown>DEFAULT2
      $a.symtab0x158b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x159440NOTYPE<unknown>DEFAULT2
      $a.symtab0x159740NOTYPE<unknown>DEFAULT2
      $a.symtab0x159b40NOTYPE<unknown>DEFAULT2
      $a.symtab0x15ac40NOTYPE<unknown>DEFAULT2
      $a.symtab0x15b940NOTYPE<unknown>DEFAULT2
      $a.symtab0x15c580NOTYPE<unknown>DEFAULT2
      $a.symtab0x15d080NOTYPE<unknown>DEFAULT2
      $a.symtab0x15df00NOTYPE<unknown>DEFAULT2
      $a.symtab0x15e100NOTYPE<unknown>DEFAULT2
      $a.symtab0x15e500NOTYPE<unknown>DEFAULT2
      $a.symtab0x15e600NOTYPE<unknown>DEFAULT2
      $a.symtab0x15e700NOTYPE<unknown>DEFAULT2
      $a.symtab0x15f100NOTYPE<unknown>DEFAULT2
      $a.symtab0x15f380NOTYPE<unknown>DEFAULT2
      $a.symtab0x15f7c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x15fc00NOTYPE<unknown>DEFAULT2
      $a.symtab0x160340NOTYPE<unknown>DEFAULT2
      $a.symtab0x160780NOTYPE<unknown>DEFAULT2
      $a.symtab0x160c00NOTYPE<unknown>DEFAULT2
      $a.symtab0x161000NOTYPE<unknown>DEFAULT2
      $a.symtab0x161440NOTYPE<unknown>DEFAULT2
      $a.symtab0x161b40NOTYPE<unknown>DEFAULT2
      $a.symtab0x161fc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x162840NOTYPE<unknown>DEFAULT2
      $a.symtab0x162c80NOTYPE<unknown>DEFAULT2
      $a.symtab0x163380NOTYPE<unknown>DEFAULT2
      $a.symtab0x163840NOTYPE<unknown>DEFAULT2
      $a.symtab0x1640c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x164540NOTYPE<unknown>DEFAULT2
      $a.symtab0x164980NOTYPE<unknown>DEFAULT2
      $a.symtab0x164e80NOTYPE<unknown>DEFAULT2
      $a.symtab0x164fc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x165c00NOTYPE<unknown>DEFAULT2
      $a.symtab0x1662c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x16fdc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1711c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x174dc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1797c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x179bc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x17ae40NOTYPE<unknown>DEFAULT2
      $a.symtab0x17b040NOTYPE<unknown>DEFAULT2
      $a.symtab0x17b200NOTYPE<unknown>DEFAULT2
      $a.symtab0x17cf80NOTYPE<unknown>DEFAULT2
      $a.symtab0x17dbc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x17f080NOTYPE<unknown>DEFAULT2
      $a.symtab0x1852c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x188f80NOTYPE<unknown>DEFAULT2
      $a.symtab0x189900NOTYPE<unknown>DEFAULT2
      $a.symtab0x189d80NOTYPE<unknown>DEFAULT2
      $a.symtab0x18ac80NOTYPE<unknown>DEFAULT2
      $a.symtab0x18c040NOTYPE<unknown>DEFAULT2
      $a.symtab0x18c5c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x18c640NOTYPE<unknown>DEFAULT2
      $a.symtab0x18c940NOTYPE<unknown>DEFAULT2
      $a.symtab0x18cec0NOTYPE<unknown>DEFAULT2
      $a.symtab0x18cf40NOTYPE<unknown>DEFAULT2
      $a.symtab0x18d240NOTYPE<unknown>DEFAULT2
      $a.symtab0x18d7c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x18d840NOTYPE<unknown>DEFAULT2
      $a.symtab0x18db40NOTYPE<unknown>DEFAULT2
      $a.symtab0x18e0c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x18e140NOTYPE<unknown>DEFAULT2
      $a.symtab0x18e400NOTYPE<unknown>DEFAULT2
      $a.symtab0x18ec80NOTYPE<unknown>DEFAULT2
      $a.symtab0x18fa40NOTYPE<unknown>DEFAULT2
      $a.symtab0x190640NOTYPE<unknown>DEFAULT2
      $a.symtab0x190b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x191100NOTYPE<unknown>DEFAULT2
      $a.symtab0x194fc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x195780NOTYPE<unknown>DEFAULT2
      $a.symtab0x195a40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1962c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x196340NOTYPE<unknown>DEFAULT2
      $a.symtab0x196400NOTYPE<unknown>DEFAULT2
      $a.symtab0x196500NOTYPE<unknown>DEFAULT2
      $a.symtab0x196600NOTYPE<unknown>DEFAULT2
      $a.symtab0x196a00NOTYPE<unknown>DEFAULT2
      $a.symtab0x197080NOTYPE<unknown>DEFAULT2
      $a.symtab0x1976c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1980c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x198380NOTYPE<unknown>DEFAULT2
      $a.symtab0x1984c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x198600NOTYPE<unknown>DEFAULT2
      $a.symtab0x198740NOTYPE<unknown>DEFAULT2
      $a.symtab0x1989c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x198d40NOTYPE<unknown>DEFAULT2
      $a.symtab0x199140NOTYPE<unknown>DEFAULT2
      $a.symtab0x199280NOTYPE<unknown>DEFAULT2
      $a.symtab0x1996c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x199ac0NOTYPE<unknown>DEFAULT2
      $a.symtab0x199ec0NOTYPE<unknown>DEFAULT2
      $a.symtab0x19a4c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x19ab80NOTYPE<unknown>DEFAULT2
      $a.symtab0x19acc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x19c440NOTYPE<unknown>DEFAULT2
      $a.symtab0x19d300NOTYPE<unknown>DEFAULT2
      $a.symtab0x1a0d40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1a4040NOTYPE<unknown>DEFAULT2
      $a.symtab0x1a4240NOTYPE<unknown>DEFAULT2
      $a.symtab0x1a8840NOTYPE<unknown>DEFAULT2
      $a.symtab0x1a9040NOTYPE<unknown>DEFAULT2
      $a.symtab0x1aa680NOTYPE<unknown>DEFAULT2
      $a.symtab0x1aa980NOTYPE<unknown>DEFAULT2
      $a.symtab0x1abdc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1acf80NOTYPE<unknown>DEFAULT2
      $a.symtab0x1afa80NOTYPE<unknown>DEFAULT2
      $a.symtab0x1b3540NOTYPE<unknown>DEFAULT2
      $a.symtab0x1b4800NOTYPE<unknown>DEFAULT2
      $a.symtab0x1b5200NOTYPE<unknown>DEFAULT2
      $a.symtab0x1b9b00NOTYPE<unknown>DEFAULT2
      $a.symtab0x1b9d00NOTYPE<unknown>DEFAULT2
      $a.symtab0x1ba300NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bb200NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bc0c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bc500NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bca00NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bcec0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bd100NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bd8c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1be840NOTYPE<unknown>DEFAULT2
      $a.symtab0x1befc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1bf640NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c1b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c1c40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c1fc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c2540NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c2ac0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c2b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c4000NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c4580NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c5340NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c5640NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c6080NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c62c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c66c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c6dc0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c7280NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c7740NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c77c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c7800NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c7ac0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c7b80NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c7c40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1c9e40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1cb340NOTYPE<unknown>DEFAULT2
      $a.symtab0x1cb500NOTYPE<unknown>DEFAULT2
      $a.symtab0x1cbb00NOTYPE<unknown>DEFAULT2
      $a.symtab0x1cc1c0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1ccd40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1ccf40NOTYPE<unknown>DEFAULT2
      $a.symtab0x1ce380NOTYPE<unknown>DEFAULT2
      $a.symtab0x1d3800NOTYPE<unknown>DEFAULT2
      $a.symtab0x1d3880NOTYPE<unknown>DEFAULT2
      $a.symtab0x1d3900NOTYPE<unknown>DEFAULT2
      $a.symtab0x1d3980NOTYPE<unknown>DEFAULT2
      $a.symtab0x1d4540NOTYPE<unknown>DEFAULT2
      $a.symtab0x1d4980NOTYPE<unknown>DEFAULT2
      $a.symtab0x1dbac0NOTYPE<unknown>DEFAULT2
      $a.symtab0x1dbf40NOTYPE<unknown>DEFAULT2
      $d.symtab0x81280NOTYPE<unknown>DEFAULT2
      $d.symtab0x270080NOTYPE<unknown>DEFAULT10
      $d.symtab0x81800NOTYPE<unknown>DEFAULT2
      $d.symtab0x270040NOTYPE<unknown>DEFAULT9
      $d.symtab0x81c40NOTYPE<unknown>DEFAULT2
      $d.symtab0x84e80NOTYPE<unknown>DEFAULT2
      $d.symtab0x90100NOTYPE<unknown>DEFAULT2
      $d.symtab0xa2900NOTYPE<unknown>DEFAULT2
      $d.symtab0xa93c0NOTYPE<unknown>DEFAULT2
      $d.symtab0xb01c0NOTYPE<unknown>DEFAULT2
      $d.symtab0xb6c80NOTYPE<unknown>DEFAULT2
      $d.symtab0xbd740NOTYPE<unknown>DEFAULT2
      $d.symtab0xc4200NOTYPE<unknown>DEFAULT2
      $d.symtab0xcacc0NOTYPE<unknown>DEFAULT2
      $d.symtab0xd1780NOTYPE<unknown>DEFAULT2
      $d.symtab0xd8240NOTYPE<unknown>DEFAULT2
      $d.symtab0xde400NOTYPE<unknown>DEFAULT2
      $d.symtab0xe7b80NOTYPE<unknown>DEFAULT2
      $d.symtab0xee100NOTYPE<unknown>DEFAULT2
      $d.symtab0xfe100NOTYPE<unknown>DEFAULT2
      $d.symtab0x101b00NOTYPE<unknown>DEFAULT2
      $d.symtab0x101f80NOTYPE<unknown>DEFAULT2
      $d.symtab0x102ec0NOTYPE<unknown>DEFAULT2
      $d.symtab0x109580NOTYPE<unknown>DEFAULT2
      $d.symtab0x270b80NOTYPE<unknown>DEFAULT13
      $d.symtab0x270bc0NOTYPE<unknown>DEFAULT13
      $d.symtab0x270c00NOTYPE<unknown>DEFAULT13
      $d.symtab0x109d80NOTYPE<unknown>DEFAULT2
      $d.symtab0x10a400NOTYPE<unknown>DEFAULT2
      $d.symtab0x10b1c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x10bf00NOTYPE<unknown>DEFAULT2
      $d.symtab0x10d480NOTYPE<unknown>DEFAULT2
      $d.symtab0x10d9c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x130c40NOTYPE<unknown>DEFAULT2
      $d.symtab0x13ae00NOTYPE<unknown>DEFAULT2
      $d.symtab0x1de4b0NOTYPE<unknown>DEFAULT4
      $d.symtab0x1de540NOTYPE<unknown>DEFAULT4
      $d.symtab0x13d500NOTYPE<unknown>DEFAULT2
      $d.symtab0x13dec0NOTYPE<unknown>DEFAULT2
      $d.symtab0x13e8c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x14b0c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x270c40NOTYPE<unknown>DEFAULT13
      $d.symtab0x00NOTYPE<unknown>DEFAULT21
      $d.symtab0x200NOTYPE<unknown>DEFAULT21
      $d.symtab0x260NOTYPE<unknown>DEFAULT21
      $d.symtab0x2c0NOTYPE<unknown>DEFAULT21
      $d.symtab0x4c0NOTYPE<unknown>DEFAULT21
      $d.symtab0x530NOTYPE<unknown>DEFAULT21
      $d.symtab0x155480NOTYPE<unknown>DEFAULT2
      $d.symtab0x156340NOTYPE<unknown>DEFAULT2
      $d.symtab0x157280NOTYPE<unknown>DEFAULT2
      $d.symtab0x1576c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x157ac0NOTYPE<unknown>DEFAULT2
      $d.symtab0x157f00NOTYPE<unknown>DEFAULT2
      $d.symtab0x158700NOTYPE<unknown>DEFAULT2
      $d.symtab0x158b40NOTYPE<unknown>DEFAULT2
      $d.symtab0x159400NOTYPE<unknown>DEFAULT2
      $d.symtab0x159b00NOTYPE<unknown>DEFAULT2
      $d.symtab0x15aa80NOTYPE<unknown>DEFAULT2
      $d.symtab0x15b8c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x15c4c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x15d000NOTYPE<unknown>DEFAULT2
      $d.symtab0x1e8780NOTYPE<unknown>DEFAULT4
      $d.symtab0x15ddc0NOTYPE<unknown>DEFAULT2
      $d.symtab0x15e0c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x15e400NOTYPE<unknown>DEFAULT2
      $d.symtab0x15f740NOTYPE<unknown>DEFAULT2
      $d.symtab0x15fb80NOTYPE<unknown>DEFAULT2
      $d.symtab0x1602c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x160700NOTYPE<unknown>DEFAULT2
      $d.symtab0x160b80NOTYPE<unknown>DEFAULT2
      $d.symtab0x160fc0NOTYPE<unknown>DEFAULT2
      $d.symtab0x1613c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x161ac0NOTYPE<unknown>DEFAULT2
      $d.symtab0x161f80NOTYPE<unknown>DEFAULT2
      $d.symtab0x1627c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x162c00NOTYPE<unknown>DEFAULT2
      $d.symtab0x163300NOTYPE<unknown>DEFAULT2
      $d.symtab0x1637c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x164040NOTYPE<unknown>DEFAULT2
      $d.symtab0x1644c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x164900NOTYPE<unknown>DEFAULT2
      $d.symtab0x164e40NOTYPE<unknown>DEFAULT2
      $d.symtab0x165b40NOTYPE<unknown>DEFAULT2
      $d.symtab0x16fb80NOTYPE<unknown>DEFAULT2
      $d.symtab0x270c80NOTYPE<unknown>DEFAULT13
      $d.symtab0x171000NOTYPE<unknown>DEFAULT2
      $d.symtab0x174bc0NOTYPE<unknown>DEFAULT2
      $d.symtab0x179600NOTYPE<unknown>DEFAULT2
      $d.symtab0x179b40NOTYPE<unknown>DEFAULT2
      $d.symtab0x17ad00NOTYPE<unknown>DEFAULT2
      $d.symtab0x270e00NOTYPE<unknown>DEFAULT13
      $d.symtab0x17ce80NOTYPE<unknown>DEFAULT2
      $d.symtab0x17d9c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x270f80NOTYPE<unknown>DEFAULT13
      $d.symtab0x17ee40NOTYPE<unknown>DEFAULT2
      $d.symtab0x185000NOTYPE<unknown>DEFAULT2
      $d.symtab0x188d00NOTYPE<unknown>DEFAULT2
      $d.symtab0x18abc0NOTYPE<unknown>DEFAULT2
      $d.symtab0x18be80NOTYPE<unknown>DEFAULT2
      $d.symtab0x18c000NOTYPE<unknown>DEFAULT2
      $d.symtab0x18c900NOTYPE<unknown>DEFAULT2
      $d.symtab0x18d200NOTYPE<unknown>DEFAULT2
      $d.symtab0x18db00NOTYPE<unknown>DEFAULT2
      $d.symtab0x18f9c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x190500NOTYPE<unknown>DEFAULT2
      $d.symtab0x190b00NOTYPE<unknown>DEFAULT2
      $d.symtab0x191040NOTYPE<unknown>DEFAULT2
      $d.symtab0x194b00NOTYPE<unknown>DEFAULT2
      $d.symtab0x271100NOTYPE<unknown>DEFAULT13
      $d.symtab0x195700NOTYPE<unknown>DEFAULT2
      $d.symtab0x195a00NOTYPE<unknown>DEFAULT2
      $d.symtab0x196200NOTYPE<unknown>DEFAULT2
      $d.symtab0x1969c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x197000NOTYPE<unknown>DEFAULT2
      $d.symtab0x197680NOTYPE<unknown>DEFAULT2
      $d.symtab0x198080NOTYPE<unknown>DEFAULT2
      $d.symtab0x198940NOTYPE<unknown>DEFAULT2
      $d.symtab0x198d00NOTYPE<unknown>DEFAULT2
      $d.symtab0x199100NOTYPE<unknown>DEFAULT2
      $d.symtab0x199680NOTYPE<unknown>DEFAULT2
      $d.symtab0x199a80NOTYPE<unknown>DEFAULT2
      $d.symtab0x199e80NOTYPE<unknown>DEFAULT2
      $d.symtab0x19a440NOTYPE<unknown>DEFAULT2
      $d.symtab0x19ab00NOTYPE<unknown>DEFAULT2
      $d.symtab0x19d1c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x1a0cc0NOTYPE<unknown>DEFAULT2
      $d.symtab0x1a3f40NOTYPE<unknown>DEFAULT2
      $d.symtab0x1a8500NOTYPE<unknown>DEFAULT2
      $d.symtab0x1a8f40NOTYPE<unknown>DEFAULT2
      $d.symtab0x1aa4c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x271280NOTYPE<unknown>DEFAULT13
      $d.symtab0x271240NOTYPE<unknown>DEFAULT13
      $d.symtab0x1af8c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x1b33c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x1b4780NOTYPE<unknown>DEFAULT2
      $d.symtab0x1bb180NOTYPE<unknown>DEFAULT2
      $d.symtab0x1bc040NOTYPE<unknown>DEFAULT2
      $d.symtab0x1bd880NOTYPE<unknown>DEFAULT2
      $d.symtab0x1be7c0NOTYPE<unknown>DEFAULT2
      $d.symtab0x1bee40NOTYPE<unknown>DEFAULT2
      $d.symtab0x1bf540NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c1900NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c1f00NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c2a00NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c3f80NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c5300NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c6040NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c6d80NOTYPE<unknown>DEFAULT2
      $d.symtab0x1c9c80NOTYPE<unknown>DEFAULT2
      $d.symtab0x1d3700NOTYPE<unknown>DEFAULT2
      $d.symtab0x580NOTYPE<unknown>DEFAULT21
      $d.symtab0x00NOTYPE<unknown>DEFAULT23
      $d.symtab0x23c0NOTYPE<unknown>DEFAULT21
      $d.symtab0xe390NOTYPE<unknown>DEFAULT23
      $d.symtab0x2711c0NOTYPE<unknown>DEFAULT13
      $d.symtab0x1e8f60NOTYPE<unknown>DEFAULT4
      C.11.5548.symtab0x1e8d412OBJECT<unknown>DEFAULT4
      C.43.5740.symtab0x1de543OBJECT<unknown>DEFAULT4
      C.44.5741.symtab0x1de4b9OBJECT<unknown>DEFAULT4
      C.5.5083.symtab0x1e87824OBJECT<unknown>DEFAULT4
      C.7.5370.symtab0x1e8e012OBJECT<unknown>DEFAULT4
      C.7.6109.symtab0x1ec1c12OBJECT<unknown>DEFAULT4
      C.7.6182.symtab0x1ebf812OBJECT<unknown>DEFAULT4
      C.8.6110.symtab0x1ec1012OBJECT<unknown>DEFAULT4
      C.9.6119.symtab0x1ec0412OBJECT<unknown>DEFAULT4
      LOCAL_ADDR.symtab0x29d484OBJECT<unknown>DEFAULT14
      Laligned.symtab0x1b9f80NOTYPE<unknown>DEFAULT2
      Llastword.symtab0x1ba140NOTYPE<unknown>DEFAULT2
      _Exit.symtab0x196a0104FUNC<unknown>DEFAULT2
      _GLOBAL_OFFSET_TABLE_.symtab0x270100OBJECT<unknown>HIDDEN12
      _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _Unwind_Complete.symtab0x1c77c4FUNC<unknown>HIDDEN2
      _Unwind_DeleteException.symtab0x1c78044FUNC<unknown>HIDDEN2
      _Unwind_ForcedUnwind.symtab0x1d43036FUNC<unknown>HIDDEN2
      _Unwind_GetCFA.symtab0x1c7748FUNC<unknown>HIDDEN2
      _Unwind_GetDataRelBase.symtab0x1c7b812FUNC<unknown>HIDDEN2
      _Unwind_GetLanguageSpecificData.symtab0x1d45468FUNC<unknown>HIDDEN2
      _Unwind_GetRegionStart.symtab0x1dbf452FUNC<unknown>HIDDEN2
      _Unwind_GetTextRelBase.symtab0x1c7ac12FUNC<unknown>HIDDEN2
      _Unwind_RaiseException.symtab0x1d3c436FUNC<unknown>HIDDEN2
      _Unwind_Resume.symtab0x1d3e836FUNC<unknown>HIDDEN2
      _Unwind_Resume_or_Rethrow.symtab0x1d40c36FUNC<unknown>HIDDEN2
      _Unwind_VRS_Get.symtab0x1c6dc76FUNC<unknown>HIDDEN2
      _Unwind_VRS_Pop.symtab0x1ccf4324FUNC<unknown>HIDDEN2
      _Unwind_VRS_Set.symtab0x1c72876FUNC<unknown>HIDDEN2
      _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_b.symtab0x2711c4OBJECT<unknown>DEFAULT13
      __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __C_ctype_b_data.symtab0x1e8f6768OBJECT<unknown>DEFAULT4
      __EH_FRAME_BEGIN__.symtab0x270000OBJECT<unknown>DEFAULT7
      __FRAME_END__.symtab0x270000OBJECT<unknown>DEFAULT7
      __GI___C_ctype_b.symtab0x2711c4OBJECT<unknown>HIDDEN13
      __GI___close.symtab0x18c20100FUNC<unknown>HIDDEN2
      __GI___close_nocancel.symtab0x18c0424FUNC<unknown>HIDDEN2
      __GI___ctype_b.symtab0x271204OBJECT<unknown>HIDDEN13
      __GI___errno_location.symtab0x15df032FUNC<unknown>HIDDEN2
      __GI___fcntl_nocancel.symtab0x154b8152FUNC<unknown>HIDDEN2
      __GI___fgetc_unlocked.symtab0x1b354300FUNC<unknown>HIDDEN2
      __GI___libc_close.symtab0x18c20100FUNC<unknown>HIDDEN2
      __GI___libc_fcntl.symtab0x15550244FUNC<unknown>HIDDEN2
      __GI___libc_open.symtab0x18cb0100FUNC<unknown>HIDDEN2
      __GI___libc_read.symtab0x18dd0100FUNC<unknown>HIDDEN2
      __GI___libc_write.symtab0x18d40100FUNC<unknown>HIDDEN2
      __GI___open.symtab0x18cb0100FUNC<unknown>HIDDEN2
      __GI___open_nocancel.symtab0x18c9424FUNC<unknown>HIDDEN2
      __GI___read.symtab0x18dd0100FUNC<unknown>HIDDEN2
      __GI___read_nocancel.symtab0x18db424FUNC<unknown>HIDDEN2
      __GI___sigaddset.symtab0x165e436FUNC<unknown>HIDDEN2
      __GI___sigdelset.symtab0x1660836FUNC<unknown>HIDDEN2
      __GI___sigismember.symtab0x165c036FUNC<unknown>HIDDEN2
      __GI___uClibc_fini.symtab0x18fe8124FUNC<unknown>HIDDEN2
      __GI___uClibc_init.symtab0x190b888FUNC<unknown>HIDDEN2
      __GI___write.symtab0x18d40100FUNC<unknown>HIDDEN2
      __GI___write_nocancel.symtab0x18d2424FUNC<unknown>HIDDEN2
      __GI__exit.symtab0x196a0104FUNC<unknown>HIDDEN2
      __GI_abort.symtab0x179bc296FUNC<unknown>HIDDEN2
      __GI_atoi.symtab0x17ae432FUNC<unknown>HIDDEN2
      __GI_bind.symtab0x15f3868FUNC<unknown>HIDDEN2
      __GI_brk.symtab0x1c25488FUNC<unknown>HIDDEN2
      __GI_close.symtab0x18c20100FUNC<unknown>HIDDEN2
      __GI_closedir.symtab0x159b4272FUNC<unknown>HIDDEN2
      __GI_config_close.symtab0x1a05852FUNC<unknown>HIDDEN2
      __GI_config_open.symtab0x1a08c72FUNC<unknown>HIDDEN2
      __GI_config_read.symtab0x19d30808FUNC<unknown>HIDDEN2
      __GI_connect.symtab0x15fc0116FUNC<unknown>HIDDEN2
      __GI_exit.symtab0x17cf8196FUNC<unknown>HIDDEN2
      __GI_fclose.symtab0x1a0d4816FUNC<unknown>HIDDEN2
      __GI_fcntl.symtab0x15550244FUNC<unknown>HIDDEN2
      __GI_fflush_unlocked.symtab0x1afa8940FUNC<unknown>HIDDEN2
      __GI_fgetc.symtab0x1aa98324FUNC<unknown>HIDDEN2
      __GI_fgetc_unlocked.symtab0x1b354300FUNC<unknown>HIDDEN2
      __GI_fgets.symtab0x1abdc284FUNC<unknown>HIDDEN2
      __GI_fgets_unlocked.symtab0x1b480160FUNC<unknown>HIDDEN2
      __GI_fopen.symtab0x1a40432FUNC<unknown>HIDDEN2
      __GI_fork.symtab0x1852c972FUNC<unknown>HIDDEN2
      __GI_fstat.symtab0x19708100FUNC<unknown>HIDDEN2
      __GI_getc_unlocked.symtab0x1b354300FUNC<unknown>HIDDEN2
      __GI_getdtablesize.symtab0x1980c44FUNC<unknown>HIDDEN2
      __GI_getegid.symtab0x1983820FUNC<unknown>HIDDEN2
      __GI_geteuid.symtab0x1984c20FUNC<unknown>HIDDEN2
      __GI_getgid.symtab0x1986020FUNC<unknown>HIDDEN2
      __GI_getpagesize.symtab0x1987440FUNC<unknown>HIDDEN2
      __GI_getpid.symtab0x1899072FUNC<unknown>HIDDEN2
      __GI_getrlimit.symtab0x1989c56FUNC<unknown>HIDDEN2
      __GI_getsockname.symtab0x1603468FUNC<unknown>HIDDEN2
      __GI_gettimeofday.symtab0x198d464FUNC<unknown>HIDDEN2
      __GI_getuid.symtab0x1991420FUNC<unknown>HIDDEN2
      __GI_inet_addr.symtab0x15f1040FUNC<unknown>HIDDEN2
      __GI_inet_aton.symtab0x1bd8c248FUNC<unknown>HIDDEN2
      __GI_ioctl.symtab0x15658224FUNC<unknown>HIDDEN2
      __GI_isatty.symtab0x1bcec36FUNC<unknown>HIDDEN2
      __GI_kill.symtab0x1573856FUNC<unknown>HIDDEN2
      __GI_listen.symtab0x160c064FUNC<unknown>HIDDEN2
      __GI_lseek64.symtab0x1c66c112FUNC<unknown>HIDDEN2
      __GI_memcpy.symtab0x15e504FUNC<unknown>HIDDEN2
      __GI_memmove.symtab0x15e604FUNC<unknown>HIDDEN2
      __GI_mempcpy.symtab0x1c60836FUNC<unknown>HIDDEN2
      __GI_memset.symtab0x15e70156FUNC<unknown>HIDDEN2
      __GI_mmap.symtab0x194fc124FUNC<unknown>HIDDEN2
      __GI_mremap.symtab0x1992868FUNC<unknown>HIDDEN2
      __GI_munmap.symtab0x1996c64FUNC<unknown>HIDDEN2
      __GI_nanosleep.symtab0x199ec96FUNC<unknown>HIDDEN2
      __GI_open.symtab0x18cb0100FUNC<unknown>HIDDEN2
      __GI_opendir.symtab0x15b94196FUNC<unknown>HIDDEN2
      __GI_raise.symtab0x189d8240FUNC<unknown>HIDDEN2
      __GI_read.symtab0x18dd0100FUNC<unknown>HIDDEN2
      __GI_readdir.symtab0x15d08232FUNC<unknown>HIDDEN2
      __GI_readdir64.symtab0x19c44236FUNC<unknown>HIDDEN2
      __GI_readlink.symtab0x1577064FUNC<unknown>HIDDEN2
      __GI_recv.symtab0x16144112FUNC<unknown>HIDDEN2
      __GI_recvfrom.symtab0x161fc136FUNC<unknown>HIDDEN2
      __GI_sbrk.symtab0x19a4c108FUNC<unknown>HIDDEN2
      __GI_select.symtab0x157f4132FUNC<unknown>HIDDEN2
      __GI_send.symtab0x162c8112FUNC<unknown>HIDDEN2
      __GI_sendto.symtab0x16384136FUNC<unknown>HIDDEN2
      __GI_setsid.symtab0x1587864FUNC<unknown>HIDDEN2
      __GI_setsockopt.symtab0x1640c72FUNC<unknown>HIDDEN2
      __GI_sigaction.symtab0x195a4136FUNC<unknown>HIDDEN2
      __GI_sigaddset.symtab0x1649880FUNC<unknown>HIDDEN2
      __GI_sigemptyset.symtab0x164e820FUNC<unknown>HIDDEN2
      __GI_signal.symtab0x164fc196FUNC<unknown>HIDDEN2
      __GI_sigprocmask.symtab0x158b8140FUNC<unknown>HIDDEN2
      __GI_sleep.symtab0x18ac8300FUNC<unknown>HIDDEN2
      __GI_socket.symtab0x1645468FUNC<unknown>HIDDEN2
      __GI_strchr.symtab0x1ba30240FUNC<unknown>HIDDEN2
      __GI_strchrnul.symtab0x1bb20236FUNC<unknown>HIDDEN2
      __GI_strcmp.symtab0x1b9b028FUNC<unknown>HIDDEN2
      __GI_strcoll.symtab0x1b9b028FUNC<unknown>HIDDEN2
      __GI_strcspn.symtab0x1bc0c68FUNC<unknown>HIDDEN2
      __GI_strlen.symtab0x1b9d096FUNC<unknown>HIDDEN2
      __GI_strrchr.symtab0x1bc5080FUNC<unknown>HIDDEN2
      __GI_strspn.symtab0x1bca076FUNC<unknown>HIDDEN2
      __GI_strtol.symtab0x17b0428FUNC<unknown>HIDDEN2
      __GI_sysconf.symtab0x17f081572FUNC<unknown>HIDDEN2
      __GI_tcgetattr.symtab0x1bd10124FUNC<unknown>HIDDEN2
      __GI_time.symtab0x1594448FUNC<unknown>HIDDEN2
      __GI_times.symtab0x19ab820FUNC<unknown>HIDDEN2
      __GI_unlink.symtab0x1597464FUNC<unknown>HIDDEN2
      __GI_write.symtab0x18d40100FUNC<unknown>HIDDEN2
      __JCR_END__.symtab0x2700c0OBJECT<unknown>DEFAULT11
      __JCR_LIST__.symtab0x2700c0OBJECT<unknown>DEFAULT11
      ___Unwind_ForcedUnwind.symtab0x1d43036FUNC<unknown>HIDDEN2
      ___Unwind_RaiseException.symtab0x1d3c436FUNC<unknown>HIDDEN2
      ___Unwind_Resume.symtab0x1d3e836FUNC<unknown>HIDDEN2
      ___Unwind_Resume_or_Rethrow.symtab0x1d40c36FUNC<unknown>HIDDEN2
      __aeabi_idiv.symtab0x153600FUNC<unknown>HIDDEN2
      __aeabi_idivmod.symtab0x1548c24FUNC<unknown>HIDDEN2
      __aeabi_read_tp.symtab0x196508FUNC<unknown>DEFAULT2
      __aeabi_uidiv.symtab0x1524c0FUNC<unknown>HIDDEN2
      __aeabi_uidivmod.symtab0x1534824FUNC<unknown>HIDDEN2
      __aeabi_unwind_cpp_pr0.symtab0x1d3908FUNC<unknown>HIDDEN2
      __aeabi_unwind_cpp_pr1.symtab0x1d3888FUNC<unknown>HIDDEN2
      __aeabi_unwind_cpp_pr2.symtab0x1d3808FUNC<unknown>HIDDEN2
      __app_fini.symtab0x277e04OBJECT<unknown>HIDDEN14
      __atexit_lock.symtab0x270f824OBJECT<unknown>DEFAULT13
      __bss_end__.symtab0x2a4780NOTYPE<unknown>DEFAULTSHN_ABS
      __bss_start.symtab0x2720c0NOTYPE<unknown>DEFAULTSHN_ABS
      __bss_start__.symtab0x2720c0NOTYPE<unknown>DEFAULTSHN_ABS
      __check_one_fd.symtab0x1906484FUNC<unknown>DEFAULT2
      __close.symtab0x18c20100FUNC<unknown>DEFAULT2
      __close_nocancel.symtab0x18c0424FUNC<unknown>DEFAULT2
      __ctype_b.symtab0x271204OBJECT<unknown>DEFAULT13
      __curbrk.symtab0x29d444OBJECT<unknown>HIDDEN14
      __cxa_begin_cleanup.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __cxa_call_unexpected.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __cxa_type_match.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __data_start.symtab0x270b80NOTYPE<unknown>DEFAULT13
      __default_rt_sa_restorer.symtab0x196440FUNC<unknown>DEFAULT2
      __default_sa_restorer.symtab0x196380FUNC<unknown>DEFAULT2
      __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __div0.symtab0x154a420FUNC<unknown>HIDDEN2
      __divsi3.symtab0x15360300FUNC<unknown>HIDDEN2
      __do_global_dtors_aux.symtab0x80f00FUNC<unknown>DEFAULT2
      __do_global_dtors_aux_fini_array_entry.symtab0x270080OBJECT<unknown>DEFAULT10
      __end__.symtab0x2a4780NOTYPE<unknown>DEFAULTSHN_ABS
      __environ.symtab0x277d84OBJECT<unknown>DEFAULT14
      __errno_location.symtab0x15df032FUNC<unknown>DEFAULT2
      __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __exidx_end.symtab0x1ed580NOTYPE<unknown>DEFAULTSHN_ABS
      __exidx_start.symtab0x1ec400NOTYPE<unknown>DEFAULTSHN_ABS
      __exit_cleanup.symtab0x272884OBJECT<unknown>HIDDEN14
      __fcntl_nocancel.symtab0x154b8152FUNC<unknown>DEFAULT2
      __fgetc_unlocked.symtab0x1b354300FUNC<unknown>DEFAULT2
      __fini_array_end.symtab0x2700c0NOTYPE<unknown>HIDDEN10
      __fini_array_start.symtab0x270080NOTYPE<unknown>HIDDEN10
      __fork.symtab0x1852c972FUNC<unknown>DEFAULT2
      __fork_generation_pointer.symtab0x2a4444OBJECT<unknown>HIDDEN14
      __fork_handlers.symtab0x2a4484OBJECT<unknown>HIDDEN14
      __fork_lock.symtab0x2728c4OBJECT<unknown>HIDDEN14
      __frame_dummy_init_array_entry.symtab0x270040OBJECT<unknown>DEFAULT9
      __getdents.symtab0x1976c160FUNC<unknown>HIDDEN2
      __getdents64.symtab0x1c2b8328FUNC<unknown>HIDDEN2
      __getpagesize.symtab0x1987440FUNC<unknown>DEFAULT2
      __getpid.symtab0x1899072FUNC<unknown>DEFAULT2
      __gnu_Unwind_Find_exidx.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __gnu_Unwind_ForcedUnwind.symtab0x1cb3428FUNC<unknown>HIDDEN2
      __gnu_Unwind_RaiseException.symtab0x1cc1c184FUNC<unknown>HIDDEN2
      __gnu_Unwind_Restore_VFP.symtab0x1d3b40FUNC<unknown>HIDDEN2
      __gnu_Unwind_Resume.symtab0x1cbb0108FUNC<unknown>HIDDEN2
      __gnu_Unwind_Resume_or_Rethrow.symtab0x1ccd432FUNC<unknown>HIDDEN2
      __gnu_Unwind_Save_VFP.symtab0x1d3bc0FUNC<unknown>HIDDEN2
      __gnu_unwind_execute.symtab0x1d4981812FUNC<unknown>HIDDEN2
      __gnu_unwind_frame.symtab0x1dbac72FUNC<unknown>HIDDEN2
      __gnu_unwind_pr_common.symtab0x1ce381352FUNC<unknown>DEFAULT2
      __h_errno_location.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __init_array_end.symtab0x270080NOTYPE<unknown>HIDDEN9
      __init_array_start.symtab0x270040NOTYPE<unknown>HIDDEN9
      __libc_close.symtab0x18c20100FUNC<unknown>DEFAULT2
      __libc_connect.symtab0x15fc0116FUNC<unknown>DEFAULT2
      __libc_disable_asynccancel.symtab0x18e40136FUNC<unknown>HIDDEN2
      __libc_enable_asynccancel.symtab0x18ec8220FUNC<unknown>HIDDEN2
      __libc_errno.symtab0x04TLS<unknown>HIDDEN8
      __libc_fcntl.symtab0x15550244FUNC<unknown>DEFAULT2
      __libc_fork.symtab0x1852c972FUNC<unknown>DEFAULT2
      __libc_h_errno.symtab0x44TLS<unknown>HIDDEN8
      __libc_multiple_threads.symtab0x2a44c4OBJECT<unknown>HIDDEN14
      __libc_nanosleep.symtab0x199ec96FUNC<unknown>DEFAULT2
      __libc_open.symtab0x18cb0100FUNC<unknown>DEFAULT2
      __libc_read.symtab0x18dd0100FUNC<unknown>DEFAULT2
      __libc_recv.symtab0x16144112FUNC<unknown>DEFAULT2
      __libc_recvfrom.symtab0x161fc136FUNC<unknown>DEFAULT2
      __libc_select.symtab0x157f4132FUNC<unknown>DEFAULT2
      __libc_send.symtab0x162c8112FUNC<unknown>DEFAULT2
      __libc_sendto.symtab0x16384136FUNC<unknown>DEFAULT2
      __libc_setup_tls.symtab0x1bf88560FUNC<unknown>DEFAULT2
      __libc_sigaction.symtab0x195a4136FUNC<unknown>DEFAULT2
      __libc_stack_end.symtab0x277d44OBJECT<unknown>DEFAULT14
      __libc_write.symtab0x18d40100FUNC<unknown>DEFAULT2
      __lll_lock_wait_private.symtab0x188f8152FUNC<unknown>HIDDEN2
      __malloc_consolidate.symtab0x1758c436FUNC<unknown>HIDDEN2
      __malloc_largebin_index.symtab0x1662c120FUNC<unknown>DEFAULT2
      __malloc_lock.symtab0x270c824OBJECT<unknown>DEFAULT13
      __malloc_state.symtab0x2a0cc888OBJECT<unknown>DEFAULT14
      __malloc_trim.symtab0x174dc176FUNC<unknown>DEFAULT2
      __nptl_deallocate_tsd.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __open.symtab0x18cb0100FUNC<unknown>DEFAULT2
      __open_nocancel.symtab0x18c9424FUNC<unknown>DEFAULT2
      __pagesize.symtab0x277dc4OBJECT<unknown>DEFAULT14
      __preinit_array_end.symtab0x270040NOTYPE<unknown>HIDDEN8
      __preinit_array_start.symtab0x270040NOTYPE<unknown>HIDDEN8
      __progname.symtab0x271144OBJECT<unknown>DEFAULT13
      __progname_full.symtab0x271184OBJECT<unknown>DEFAULT13
      __pthread_initialize_minimal.symtab0x1c1b812FUNC<unknown>DEFAULT2
      __pthread_mutex_init.symtab0x18fac8FUNC<unknown>DEFAULT2
      __pthread_mutex_lock.symtab0x18fa48FUNC<unknown>DEFAULT2
      __pthread_mutex_trylock.symtab0x18fa48FUNC<unknown>DEFAULT2
      __pthread_mutex_unlock.symtab0x18fa48FUNC<unknown>DEFAULT2
      __pthread_return_0.symtab0x18fa48FUNC<unknown>DEFAULT2
      __pthread_unwind.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __read.symtab0x18dd0100FUNC<unknown>DEFAULT2
      __read_nocancel.symtab0x18db424FUNC<unknown>DEFAULT2
      __register_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
      __restore_core_regs.symtab0x1d39828FUNC<unknown>HIDDEN2
      __rtld_fini.symtab0x277e44OBJECT<unknown>HIDDEN14
      __sigaddset.symtab0x165e436FUNC<unknown>DEFAULT2
      __sigdelset.symtab0x1660836FUNC<unknown>DEFAULT2
      __sigismember.symtab0x165c036FUNC<unknown>DEFAULT2
      __sigjmp_save.symtab0x1c62c64FUNC<unknown>HIDDEN2
      __sigsetjmp.symtab0x1c2ac12FUNC<unknown>DEFAULT2
      __stdin.symtab0x271344OBJECT<unknown>DEFAULT13
      __stdio_READ.symtab0x1c40088FUNC<unknown>HIDDEN2
      __stdio_WRITE.symtab0x1c458220FUNC<unknown>HIDDEN2
      __stdio_rfill.symtab0x1c53448FUNC<unknown>HIDDEN2
      __stdio_trans2r_o.symtab0x1c564164FUNC<unknown>HIDDEN2
      __stdio_wcommit.symtab0x1aa6848FUNC<unknown>HIDDEN2
      __stdout.symtab0x271384OBJECT<unknown>DEFAULT13
      __sys_connect.symtab0x15f7c68FUNC<unknown>DEFAULT2
      __sys_recv.symtab0x1610068FUNC<unknown>DEFAULT2
      __sys_recvfrom.symtab0x161b472FUNC<unknown>DEFAULT2
      __sys_send.symtab0x1628468FUNC<unknown>DEFAULT2
      __sys_sendto.symtab0x1633876FUNC<unknown>DEFAULT2
      __syscall_error.symtab0x1957844FUNC<unknown>HIDDEN2
      __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_nanosleep.symtab0x199ac64FUNC<unknown>DEFAULT2
      __syscall_rt_sigaction.symtab0x1966064FUNC<unknown>DEFAULT2
      __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __syscall_select.symtab0x157b068FUNC<unknown>DEFAULT2
      __tls_get_addr.symtab0x1bf6436FUNC<unknown>DEFAULT2
      __uClibc_fini.symtab0x18fe8124FUNC<unknown>DEFAULT2
      __uClibc_init.symtab0x190b888FUNC<unknown>DEFAULT2
      __uClibc_main.symtab0x191101004FUNC<unknown>DEFAULT2
      __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      __uclibc_progname.symtab0x271104OBJECT<unknown>HIDDEN13
      __udivsi3.symtab0x1524c252FUNC<unknown>HIDDEN2
      __write.symtab0x18d40100FUNC<unknown>DEFAULT2
      __write_nocancel.symtab0x18d2424FUNC<unknown>DEFAULT2
      __xstat32_conv.symtab0x19b98172FUNC<unknown>HIDDEN2
      __xstat64_conv.symtab0x19acc204FUNC<unknown>HIDDEN2
      _bss_end__.symtab0x2a4780NOTYPE<unknown>DEFAULTSHN_ABS
      _dl_aux_init.symtab0x1c1c456FUNC<unknown>DEFAULT2
      _dl_nothread_init_static_tls.symtab0x1c1fc88FUNC<unknown>HIDDEN2
      _dl_phdr.symtab0x2a4704OBJECT<unknown>DEFAULT14
      _dl_phnum.symtab0x2a4744OBJECT<unknown>DEFAULT14
      _dl_tls_dtv_gaps.symtab0x2a4641OBJECT<unknown>DEFAULT14
      _dl_tls_dtv_slotinfo_list.symtab0x2a4604OBJECT<unknown>DEFAULT14
      _dl_tls_generation.symtab0x2a4684OBJECT<unknown>DEFAULT14
      _dl_tls_max_dtv_idx.symtab0x2a4584OBJECT<unknown>DEFAULT14
      _dl_tls_setup.symtab0x1befc104FUNC<unknown>DEFAULT2
      _dl_tls_static_align.symtab0x2a4544OBJECT<unknown>DEFAULT14
      _dl_tls_static_nelem.symtab0x2a46c4OBJECT<unknown>DEFAULT14
      _dl_tls_static_size.symtab0x2a45c4OBJECT<unknown>DEFAULT14
      _dl_tls_static_used.symtab0x2a4504OBJECT<unknown>DEFAULT14
      _edata.symtab0x2720c0NOTYPE<unknown>DEFAULTSHN_ABS
      _end.symtab0x2a4780NOTYPE<unknown>DEFAULTSHN_ABS
      _exit.symtab0x196a0104FUNC<unknown>DEFAULT2
      _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _fini.symtab0x1dc280FUNC<unknown>DEFAULT3
      _fixed_buffers.symtab0x278088192OBJECT<unknown>DEFAULT14
      _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _init.symtab0x80d40FUNC<unknown>DEFAULT1
      _memcpy.symtab0x1b5200FUNC<unknown>HIDDEN2
      _pthread_cleanup_pop_restore.symtab0x18fbc44FUNC<unknown>DEFAULT2
      _pthread_cleanup_push_defer.symtab0x18fb48FUNC<unknown>DEFAULT2
      _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _setjmp.symtab0x1962c8FUNC<unknown>DEFAULT2
      _sigintr.symtab0x2a0c48OBJECT<unknown>HIDDEN14
      _start.symtab0x81940FUNC<unknown>DEFAULT2
      _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _stdio_fopen.symtab0x1a4241120FUNC<unknown>HIDDEN2
      _stdio_init.symtab0x1a884128FUNC<unknown>HIDDEN2
      _stdio_openlist.symtab0x2713c4OBJECT<unknown>DEFAULT13
      _stdio_openlist_add_lock.symtab0x277e812OBJECT<unknown>DEFAULT14
      _stdio_openlist_dec_use.symtab0x1acf8688FUNC<unknown>HIDDEN2
      _stdio_openlist_del_count.symtab0x278044OBJECT<unknown>DEFAULT14
      _stdio_openlist_del_lock.symtab0x277f412OBJECT<unknown>DEFAULT14
      _stdio_openlist_use_count.symtab0x278004OBJECT<unknown>DEFAULT14
      _stdio_streams.symtab0x27140204OBJECT<unknown>DEFAULT13
      _stdio_term.symtab0x1a904356FUNC<unknown>HIDDEN2
      _stdio_user_locking.symtab0x271244OBJECT<unknown>DEFAULT13
      _stdlib_strto_l.symtab0x17b20472FUNC<unknown>HIDDEN2
      _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      abort.symtab0x179bc296FUNC<unknown>DEFAULT2
      abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      add_auth_entry.symtab0x10bf4352FUNC<unknown>DEFAULT2
      anti_gdb_entry.symtab0x101a024FUNC<unknown>DEFAULT2
      atoi.symtab0x17ae432FUNC<unknown>DEFAULT2
      atol.symtab0x17ae432FUNC<unknown>DEFAULT2
      atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      attack.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      attack_app.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      attack_app_http.symtab0x81d08048FUNC<unknown>DEFAULT2
      attack_get_opt_int.symtab0xa520112FUNC<unknown>DEFAULT2
      attack_get_opt_ip.symtab0xa4b4108FUNC<unknown>DEFAULT2
      attack_get_opt_str.symtab0xa14092FUNC<unknown>DEFAULT2
      attack_init.symtab0xa590996FUNC<unknown>DEFAULT2
      attack_method.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      attack_method_asyn.symtab0xb0201708FUNC<unknown>DEFAULT2
      attack_method_greip.symtab0xd8281564FUNC<unknown>DEFAULT2
      attack_method_ovh.symtab0xa9741708FUNC<unknown>DEFAULT2
      attack_method_std.symtab0xde44672FUNC<unknown>DEFAULT2
      attack_method_tcpack.symtab0xcad01708FUNC<unknown>DEFAULT2
      attack_method_tcpall.symtab0xbd781708FUNC<unknown>DEFAULT2
      attack_method_tcpfrag.symtab0xb6cc1708FUNC<unknown>DEFAULT2
      attack_method_tcpsyn.symtab0xd17c1708FUNC<unknown>DEFAULT2
      attack_method_tcpusyn.symtab0xc4241708FUNC<unknown>DEFAULT2
      attack_method_udpgame.symtab0xe3841080FUNC<unknown>DEFAULT2
      attack_method_udpplain.symtab0xe0e4672FUNC<unknown>DEFAULT2
      attack_parse.symtab0xa298540FUNC<unknown>DEFAULT2
      attack_start.symtab0xa19c252FUNC<unknown>DEFAULT2
      auth_table.symtab0x272784OBJECT<unknown>DEFAULT14
      auth_table_len.symtab0x2724c4OBJECT<unknown>DEFAULT14
      auth_table_max_weight.symtab0x2727c2OBJECT<unknown>DEFAULT14
      been_there_done_that.symtab0x272844OBJECT<unknown>DEFAULT14
      bind.symtab0x15f3868FUNC<unknown>DEFAULT2
      bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      brk.symtab0x1c25488FUNC<unknown>DEFAULT2
      brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      bsd_signal.symtab0x164fc196FUNC<unknown>DEFAULT2
      calloc.symtab0x16fdc320FUNC<unknown>DEFAULT2
      calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      checksum_generic.symtab0xe7bc80FUNC<unknown>DEFAULT2
      checksum_tcpudp.symtab0xe80c164FUNC<unknown>DEFAULT2
      clock.symtab0x15e1052FUNC<unknown>DEFAULT2
      clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      close.symtab0x18c20100FUNC<unknown>DEFAULT2
      closedir.symtab0x159b4272FUNC<unknown>DEFAULT2
      closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      completed.5105.symtab0x2720c1OBJECT<unknown>DEFAULT14
      conn_table.symtab0x29d644OBJECT<unknown>DEFAULT14
      connect.symtab0x15fc0116FUNC<unknown>DEFAULT2
      connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      environ.symtab0x277d84OBJECT<unknown>DEFAULT14
      errno.symtab0x04TLS<unknown>DEFAULT8
      errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      exit.symtab0x17cf8196FUNC<unknown>DEFAULT2
      exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fake_time.symtab0x272804OBJECT<unknown>DEFAULT14
      fclose.symtab0x1a0d4816FUNC<unknown>DEFAULT2
      fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fcntl.symtab0x15550244FUNC<unknown>DEFAULT2
      fd_ctrl.symtab0x270b84OBJECT<unknown>DEFAULT13
      fd_serv.symtab0x270bc4OBJECT<unknown>DEFAULT13
      fd_to_DIR.symtab0x15ac4208FUNC<unknown>DEFAULT2
      fdopendir.symtab0x15c58176FUNC<unknown>DEFAULT2
      fflush_unlocked.symtab0x1afa8940FUNC<unknown>DEFAULT2
      fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgetc.symtab0x1aa98324FUNC<unknown>DEFAULT2
      fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgetc_unlocked.symtab0x1b354300FUNC<unknown>DEFAULT2
      fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgets.symtab0x1abdc284FUNC<unknown>DEFAULT2
      fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fgets_unlocked.symtab0x1b480160FUNC<unknown>DEFAULT2
      fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fopen.symtab0x1a40432FUNC<unknown>DEFAULT2
      fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fork.symtab0x1852c972FUNC<unknown>DEFAULT2
      fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fork_handler_pool.symtab0x272901348OBJECT<unknown>DEFAULT14
      frame_dummy.symtab0x81340FUNC<unknown>DEFAULT2
      free.symtab0x17740572FUNC<unknown>DEFAULT2
      free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      fstat.symtab0x19708100FUNC<unknown>DEFAULT2
      fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      get_eit_entry.symtab0x1c7c4544FUNC<unknown>DEFAULT2
      getc.symtab0x1aa98324FUNC<unknown>DEFAULT2
      getc_unlocked.symtab0x1b354300FUNC<unknown>DEFAULT2
      getdents.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getdtablesize.symtab0x1980c44FUNC<unknown>DEFAULT2
      getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getegid.symtab0x1983820FUNC<unknown>DEFAULT2
      getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      geteuid.symtab0x1984c20FUNC<unknown>DEFAULT2
      geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getgid.symtab0x1986020FUNC<unknown>DEFAULT2
      getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getpagesize.symtab0x1987440FUNC<unknown>DEFAULT2
      getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getpid.symtab0x1899072FUNC<unknown>DEFAULT2
      getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getppid.symtab0x1564420FUNC<unknown>DEFAULT2
      getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getrlimit.symtab0x1989c56FUNC<unknown>DEFAULT2
      getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getsockname.symtab0x1603468FUNC<unknown>DEFAULT2
      getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getsockopt.symtab0x1607872FUNC<unknown>DEFAULT2
      getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      gettimeofday.symtab0x198d464FUNC<unknown>DEFAULT2
      gettimeofday.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      getuid.symtab0x1991420FUNC<unknown>DEFAULT2
      getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      h_errno.symtab0x44TLS<unknown>DEFAULT8
      index.symtab0x1ba30240FUNC<unknown>DEFAULT2
      inet_addr.symtab0x15f1040FUNC<unknown>DEFAULT2
      inet_aton.symtab0x1bd8c248FUNC<unknown>DEFAULT2
      inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      init_static_tls.symtab0x1be84120FUNC<unknown>DEFAULT2
      initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      ioctl.symtab0x15658224FUNC<unknown>DEFAULT2
      ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      isatty.symtab0x1bcec36FUNC<unknown>DEFAULT2
      isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      kill.symtab0x1573856FUNC<unknown>DEFAULT2
      kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      killer.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      killer_init.symtab0xee185000FUNC<unknown>DEFAULT2
      killer_kill_by_port.symtab0xe8b01384FUNC<unknown>DEFAULT2
      killer_pid.symtab0x29d504OBJECT<unknown>DEFAULT14
      killer_realpath.symtab0x29d4c4OBJECT<unknown>DEFAULT14
      killer_realpath_len.symtab0x272304OBJECT<unknown>DEFAULT14
      libc-cancellation.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc-lowlevellock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc-tls.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      libc_multiple_threads.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      listen.symtab0x160c064FUNC<unknown>DEFAULT2
      listen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      lseek64.symtab0x1c66c112FUNC<unknown>DEFAULT2
      main.symtab0x102f01692FUNC<unknown>DEFAULT2
      main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      malloc.symtab0x166a42360FUNC<unknown>DEFAULT2
      malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      malloc_trim.symtab0x1797c64FUNC<unknown>DEFAULT2
      memcpy.symtab0x15e504FUNC<unknown>DEFAULT2
      memmove.symtab0x15e604FUNC<unknown>DEFAULT2
      mempcpy.symtab0x1c60836FUNC<unknown>DEFAULT2
      mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      memset.symtab0x15e70156FUNC<unknown>DEFAULT2
      methods.symtab0x2722c4OBJECT<unknown>DEFAULT14
      methods_len.symtab0x272281OBJECT<unknown>DEFAULT14
      mmap.symtab0x194fc124FUNC<unknown>DEFAULT2
      mmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mremap.symtab0x1992868FUNC<unknown>DEFAULT2
      mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      munmap.symtab0x1996c64FUNC<unknown>DEFAULT2
      munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      mylock.symtab0x270e024OBJECT<unknown>DEFAULT13
      nanosleep.symtab0x199ec96FUNC<unknown>DEFAULT2
      nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      nprocessors_onln.symtab0x17dbc332FUNC<unknown>DEFAULT2
      object.5113.symtab0x2721024OBJECT<unknown>DEFAULT14
      open.symtab0x18cb0100FUNC<unknown>DEFAULT2
      opendir.symtab0x15b94196FUNC<unknown>DEFAULT2
      opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      parse_config.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      pending_connection.symtab0x272381OBJECT<unknown>DEFAULT14
      pr-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      program_invocation_name.symtab0x271184OBJECT<unknown>DEFAULT13
      program_invocation_short_name.symtab0x271144OBJECT<unknown>DEFAULT13
      raise.symtab0x189d8240FUNC<unknown>DEFAULT2
      raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      rand_init.symtab0x109e8104FUNC<unknown>DEFAULT2
      rand_next.symtab0x1098c92FUNC<unknown>DEFAULT2
      rand_str.symtab0x10a50220FUNC<unknown>DEFAULT2
      random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      read.symtab0x18dd0100FUNC<unknown>DEFAULT2
      readdir.symtab0x15d08232FUNC<unknown>DEFAULT2
      readdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      readdir64.symtab0x19c44236FUNC<unknown>DEFAULT2
      readdir64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      readlink.symtab0x1577064FUNC<unknown>DEFAULT2
      readlink.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      realloc.symtab0x1711c960FUNC<unknown>DEFAULT2
      realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      recv.symtab0x16144112FUNC<unknown>DEFAULT2
      recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      recvfrom.symtab0x161fc136FUNC<unknown>DEFAULT2
      recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      register-atfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      resolve_cnc_addr.symtab0x101b872FUNC<unknown>DEFAULT2
      resolve_func.symtab0x270c04OBJECT<unknown>DEFAULT13
      restore_core_regs.symtab0x1d39828FUNC<unknown>HIDDEN2
      rindex.symtab0x1bc5080FUNC<unknown>DEFAULT2
      rsck.symtab0x29d684OBJECT<unknown>DEFAULT14
      rsck_out.symtab0x29d704OBJECT<unknown>DEFAULT14
      sbrk.symtab0x19a4c108FUNC<unknown>DEFAULT2
      sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      scanner.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      scanner_init.symtab0x10d5412252FUNC<unknown>DEFAULT2
      scanner_pid.symtab0x29d6c4OBJECT<unknown>DEFAULT14
      scanner_rawpkt.symtab0x2725040OBJECT<unknown>DEFAULT14
      select.symtab0x157f4132FUNC<unknown>DEFAULT2
      select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      send.symtab0x162c8112FUNC<unknown>DEFAULT2
      send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sendto.symtab0x16384136FUNC<unknown>DEFAULT2
      sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setsid.symtab0x1587864FUNC<unknown>DEFAULT2
      setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setsockopt.symtab0x1640c72FUNC<unknown>DEFAULT2
      setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      setup_connection.symtab0x10b2c200FUNC<unknown>DEFAULT2
      sigaction.symtab0x195a4136FUNC<unknown>DEFAULT2
      sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigaddset.symtab0x1649880FUNC<unknown>DEFAULT2
      sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigemptyset.symtab0x164e820FUNC<unknown>DEFAULT2
      sigjmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      signal.symtab0x164fc196FUNC<unknown>DEFAULT2
      signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigprocmask.symtab0x158b8140FUNC<unknown>DEFAULT2
      sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sleep.symtab0x18ac8300FUNC<unknown>DEFAULT2
      sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      socket.symtab0x1645468FUNC<unknown>DEFAULT2
      socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      srv_addr.symtab0x29d5416OBJECT<unknown>DEFAULT14
      static_dtv.symtab0x29808512OBJECT<unknown>DEFAULT14
      static_map.symtab0x29d1052OBJECT<unknown>DEFAULT14
      static_slotinfo.symtab0x29a08776OBJECT<unknown>DEFAULT14
      stderr.symtab0x271304OBJECT<unknown>DEFAULT13
      stdin.symtab0x271284OBJECT<unknown>DEFAULT13
      stdout.symtab0x2712c4OBJECT<unknown>DEFAULT13
      strchr.symtab0x1ba30240FUNC<unknown>DEFAULT2
      strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strchrnul.symtab0x1bb20236FUNC<unknown>DEFAULT2
      strchrnul.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strcmp.symtab0x1b9b028FUNC<unknown>DEFAULT2
      strcoll.symtab0x1b9b028FUNC<unknown>DEFAULT2
      strcspn.symtab0x1bc0c68FUNC<unknown>DEFAULT2
      strcspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strlen.symtab0x1b9d096FUNC<unknown>DEFAULT2
      strrchr.symtab0x1bc5080FUNC<unknown>DEFAULT2
      strrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strspn.symtab0x1bca076FUNC<unknown>DEFAULT2
      strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      strtol.symtab0x17b0428FUNC<unknown>DEFAULT2
      strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      sysconf.symtab0x17f081572FUNC<unknown>DEFAULT2
      sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      table.symtab0x29d74848OBJECT<unknown>DEFAULT14
      table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
      table_init.symtab0x13e943528FUNC<unknown>DEFAULT2
      table_key.symtab0x270c44OBJECT<unknown>DEFAULT13
      table_lock_val.symtab0x13d54160FUNC<unknown>DEFAULT2

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Jun 23, 2022 17:56:07.519762993 CEST42836443192.168.2.2391.189.91.43
      Jun 23, 2022 17:56:08.287548065 CEST4251680192.168.2.23109.202.202.202
      Jun 23, 2022 17:56:08.645222902 CEST456021791192.168.2.23139.59.109.181
      Jun 23, 2022 17:56:08.688745022 CEST2344423192.168.2.2376.64.177.212
      Jun 23, 2022 17:56:08.688816071 CEST2344423192.168.2.23178.165.118.212
      Jun 23, 2022 17:56:08.688842058 CEST2344423192.168.2.23103.7.215.153
      Jun 23, 2022 17:56:08.688853025 CEST2344423192.168.2.23198.15.174.197
      Jun 23, 2022 17:56:08.688862085 CEST2344423192.168.2.2345.13.59.133
      Jun 23, 2022 17:56:08.688872099 CEST2344423192.168.2.23216.76.77.227
      Jun 23, 2022 17:56:08.688883066 CEST2344423192.168.2.23112.186.250.68
      Jun 23, 2022 17:56:08.688893080 CEST2344423192.168.2.2339.241.44.222
      Jun 23, 2022 17:56:08.688905001 CEST2344423192.168.2.23250.129.247.102
      Jun 23, 2022 17:56:08.688915014 CEST2344423192.168.2.2338.143.239.55
      Jun 23, 2022 17:56:08.688919067 CEST2344423192.168.2.23193.212.17.109
      Jun 23, 2022 17:56:08.688921928 CEST2344423192.168.2.23115.207.164.250
      Jun 23, 2022 17:56:08.688930988 CEST2344423192.168.2.23179.49.120.173
      Jun 23, 2022 17:56:08.688937902 CEST2344423192.168.2.23161.59.111.98
      Jun 23, 2022 17:56:08.688956022 CEST2344423192.168.2.23133.37.119.128
      Jun 23, 2022 17:56:08.688956976 CEST2344423192.168.2.23120.8.186.192
      Jun 23, 2022 17:56:08.688966990 CEST2344423192.168.2.23113.95.4.38
      Jun 23, 2022 17:56:08.688986063 CEST2344423192.168.2.2358.157.157.44
      Jun 23, 2022 17:56:08.688997030 CEST2344423192.168.2.23176.75.22.31
      Jun 23, 2022 17:56:08.688999891 CEST2344423192.168.2.23114.6.103.195
      Jun 23, 2022 17:56:08.689011097 CEST2344423192.168.2.23113.171.122.115
      Jun 23, 2022 17:56:08.689022064 CEST2344423192.168.2.23123.149.103.18
      Jun 23, 2022 17:56:08.689069986 CEST2344423192.168.2.2383.192.49.152
      Jun 23, 2022 17:56:08.689078093 CEST2344423192.168.2.2396.1.17.14
      Jun 23, 2022 17:56:08.689078093 CEST2344423192.168.2.23247.112.198.170
      Jun 23, 2022 17:56:08.689083099 CEST2344423192.168.2.23151.105.55.144
      Jun 23, 2022 17:56:08.689090014 CEST2344423192.168.2.2313.250.60.254
      Jun 23, 2022 17:56:08.689097881 CEST2344423192.168.2.23204.176.35.80
      Jun 23, 2022 17:56:08.689110041 CEST2344423192.168.2.2368.167.102.125
      Jun 23, 2022 17:56:08.689121962 CEST2344423192.168.2.2339.43.41.130
      Jun 23, 2022 17:56:08.689126968 CEST2344423192.168.2.23111.229.26.140
      Jun 23, 2022 17:56:08.689136028 CEST2344423192.168.2.2345.86.67.31
      Jun 23, 2022 17:56:08.689141989 CEST2344423192.168.2.2353.46.52.97
      Jun 23, 2022 17:56:08.689160109 CEST2344423192.168.2.2313.123.82.113
      Jun 23, 2022 17:56:08.689172029 CEST2344423192.168.2.23142.185.91.38
      Jun 23, 2022 17:56:08.689183950 CEST2344423192.168.2.231.82.7.12
      Jun 23, 2022 17:56:08.689196110 CEST2344423192.168.2.23175.229.150.209
      Jun 23, 2022 17:56:08.689197063 CEST2344423192.168.2.23250.206.123.186
      Jun 23, 2022 17:56:08.689209938 CEST2344423192.168.2.23135.254.86.35
      Jun 23, 2022 17:56:08.689219952 CEST2344423192.168.2.23136.150.57.0
      Jun 23, 2022 17:56:08.689239025 CEST2344423192.168.2.23176.88.152.151
      Jun 23, 2022 17:56:08.689241886 CEST2344423192.168.2.2342.1.171.176
      Jun 23, 2022 17:56:08.689248085 CEST2344423192.168.2.2372.233.147.136
      Jun 23, 2022 17:56:08.689259052 CEST2344423192.168.2.23209.164.60.243
      Jun 23, 2022 17:56:08.689265966 CEST2344423192.168.2.2386.255.50.76
      Jun 23, 2022 17:56:08.689290047 CEST2344423192.168.2.2319.21.208.57
      Jun 23, 2022 17:56:08.689327002 CEST2344423192.168.2.2362.50.255.23
      Jun 23, 2022 17:56:08.689330101 CEST2344423192.168.2.23176.63.24.176
      Jun 23, 2022 17:56:08.689342022 CEST2344423192.168.2.2399.193.7.148
      Jun 23, 2022 17:56:08.689368010 CEST2344423192.168.2.23249.249.120.189
      Jun 23, 2022 17:56:08.689376116 CEST2344423192.168.2.23240.143.6.25
      Jun 23, 2022 17:56:08.689377069 CEST2344423192.168.2.23208.249.10.110
      Jun 23, 2022 17:56:08.689383984 CEST2344423192.168.2.23223.225.85.133
      Jun 23, 2022 17:56:08.689388037 CEST2344423192.168.2.23164.131.164.246
      Jun 23, 2022 17:56:08.689400911 CEST2344423192.168.2.23118.37.199.210
      Jun 23, 2022 17:56:08.689408064 CEST2344423192.168.2.23176.171.121.169
      Jun 23, 2022 17:56:08.689429045 CEST2344423192.168.2.23209.230.142.30
      Jun 23, 2022 17:56:08.689455986 CEST2344423192.168.2.2372.6.196.148
      Jun 23, 2022 17:56:08.689460993 CEST2344423192.168.2.23202.219.41.68
      Jun 23, 2022 17:56:08.689467907 CEST2344423192.168.2.23151.166.210.205
      Jun 23, 2022 17:56:08.689469099 CEST2344423192.168.2.23213.98.102.62
      Jun 23, 2022 17:56:08.689471006 CEST2344423192.168.2.23194.56.78.250
      Jun 23, 2022 17:56:08.689474106 CEST2344423192.168.2.23244.210.83.76
      Jun 23, 2022 17:56:08.689476013 CEST2344423192.168.2.23173.84.253.85
      Jun 23, 2022 17:56:08.689491034 CEST2344423192.168.2.23211.120.12.157
      Jun 23, 2022 17:56:08.689507008 CEST2344423192.168.2.23120.135.231.7
      Jun 23, 2022 17:56:08.689512968 CEST2344423192.168.2.2320.61.138.48
      Jun 23, 2022 17:56:08.689516068 CEST2344423192.168.2.23245.10.183.111
      Jun 23, 2022 17:56:08.689557076 CEST2344423192.168.2.2334.129.195.77
      Jun 23, 2022 17:56:08.689568996 CEST2344423192.168.2.2382.246.150.61
      Jun 23, 2022 17:56:08.689573050 CEST2344423192.168.2.2398.87.13.94
      Jun 23, 2022 17:56:08.689589024 CEST2344423192.168.2.23123.122.218.63
      Jun 23, 2022 17:56:08.689588070 CEST2344423192.168.2.2317.6.240.223
      Jun 23, 2022 17:56:08.689594984 CEST2344423192.168.2.23241.194.126.116
      Jun 23, 2022 17:56:08.689603090 CEST2344423192.168.2.2359.161.57.181
      Jun 23, 2022 17:56:08.689604998 CEST2344423192.168.2.2359.224.83.46
      Jun 23, 2022 17:56:08.689635992 CEST2344423192.168.2.23169.220.233.66
      Jun 23, 2022 17:56:08.689635992 CEST2344423192.168.2.2336.230.121.64
      Jun 23, 2022 17:56:08.689636946 CEST2344423192.168.2.23188.34.40.147
      Jun 23, 2022 17:56:08.689651966 CEST2344423192.168.2.2367.182.41.24
      Jun 23, 2022 17:56:08.689651966 CEST2344423192.168.2.23115.211.162.201
      Jun 23, 2022 17:56:08.689662933 CEST2344423192.168.2.23181.216.44.68
      Jun 23, 2022 17:56:08.689667940 CEST2344423192.168.2.23222.72.111.114
      Jun 23, 2022 17:56:08.689667940 CEST2344423192.168.2.2387.32.88.126
      Jun 23, 2022 17:56:08.689688921 CEST2344423192.168.2.23253.239.118.55
      Jun 23, 2022 17:56:08.689702988 CEST2344423192.168.2.23110.63.91.1
      Jun 23, 2022 17:56:08.689703941 CEST2344423192.168.2.23251.45.146.79
      Jun 23, 2022 17:56:08.689712048 CEST2344423192.168.2.2344.1.203.127
      Jun 23, 2022 17:56:08.689722061 CEST2344423192.168.2.239.139.69.217
      Jun 23, 2022 17:56:08.689723015 CEST2344423192.168.2.2320.201.168.24
      Jun 23, 2022 17:56:08.689724922 CEST2344423192.168.2.23118.236.115.251
      Jun 23, 2022 17:56:08.689726114 CEST2344423192.168.2.23167.59.212.66
      Jun 23, 2022 17:56:08.689726114 CEST2344423192.168.2.2395.58.12.82
      Jun 23, 2022 17:56:08.689732075 CEST2344423192.168.2.23173.145.242.232
      Jun 23, 2022 17:56:08.689733028 CEST2344423192.168.2.23247.72.151.255
      Jun 23, 2022 17:56:08.689737082 CEST2344423192.168.2.23151.83.157.188
      Jun 23, 2022 17:56:08.689752102 CEST2344423192.168.2.23211.160.154.197

      System Behavior

      General

      Start time:17:56:07
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:/tmp/loligang.arm7
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:17:56:07
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:17:56:07
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:17:56:07
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:17:56:07
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:17:56:07
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:17:56:08
      Start date:23/06/2022
      Path:/tmp/loligang.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1