Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
VBeQtQfmgh

Overview

General Information

Sample Name:VBeQtQfmgh
Analysis ID:679493
MD5:147b877d92cb69a4f47a6d6c9e4481db
SHA1:c37890898f0faef6f92fe1cd2506bf11be2fcf75
SHA256:323eb2ac9034ac59a744a4743f3de35307a4a05a24af0cf75b89bf17ff8d0d6d
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample deletes itself
Uses known network protocols on non-standard ports
Contains symbols with names commonly found in malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679493
Start date and time: 05/08/202221:58:362022-08-05 21:58:36 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 54s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:VBeQtQfmgh
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal100.troj.evad.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/VBeQtQfmgh
PID:6229
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
BEASTMODE-BITCHES@@""""/p
Standard Error:

Process Tree

  • system is lnxubuntu20
  • VBeQtQfmgh (PID: 6229, Parent: 6122, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/VBeQtQfmgh
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
VBeQtQfmghMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
  • 0x144f8:$x1: POST /cdn-cgi/
  • 0x149b4:$s1: LCOGQGPTGP
VBeQtQfmghMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
  • 0x144f8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
VBeQtQfmghMAL_ARM_LNX_Mirai_Mar13_2022Detects new ARM Mirai variantMehmet Ali Kerimoglu a.k.a. CYB3RMX
  • 0x1fbbd:$attck1: attack.c
  • 0x1fc14:$attck3: anti_gdb_entry
  • 0x1fc23:$attck4: resolve_cnc_addr
  • 0x2085c:$attck7: attack_get_opt_ip
VBeQtQfmghJoeSecurity_Mirai_5Yara detected MiraiJoe Security
    VBeQtQfmghJoeSecurity_Mirai_8Yara detected MiraiJoe Security

      PCAP (Network Traffic)

      SourceRuleDescriptionAuthorStrings
      dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
        • 0x144f8:$x1: POST /cdn-cgi/
        • 0x149b4:$s1: LCOGQGPTGP
        6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
        • 0x144f8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
        6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
          6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
          • 0x144f8:$x1: POST /cdn-cgi/
          • 0x149b4:$s1: LCOGQGPTGP
          6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
          • 0x144f8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
          Click to see the 7 entries

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: VBeQtQfmghAvira: detected
          Multi AV Scanner detection for submitted file
          Source: VBeQtQfmghVirustotal: Detection: 62%Perma Link

          Networking

          barindex
          Uses known network protocols on non-standard ports
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56956
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56960
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56964
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56972
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56974
          Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
          Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
          Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
          Source: global trafficTCP traffic: 192.168.2.23:53692 -> 163.123.143.71:34241
          Source: /tmp/VBeQtQfmgh (PID: 6229)Socket: 127.0.0.1::42516
          Source: /tmp/VBeQtQfmgh (PID: 6233)Socket: 0.0.0.0::23
          Source: /tmp/VBeQtQfmgh (PID: 6233)Socket: 0.0.0.0::0
          Source: /tmp/VBeQtQfmgh (PID: 6233)Socket: 0.0.0.0::80
          Source: /tmp/VBeQtQfmgh (PID: 6233)Socket: 0.0.0.0::81
          Source: /tmp/VBeQtQfmgh (PID: 6233)Socket: 0.0.0.0::8443
          Source: /tmp/VBeQtQfmgh (PID: 6233)Socket: 0.0.0.0::9009
          Source: /tmp/VBeQtQfmgh (PID: 6247)Socket: 0.0.0.0::23
          Source: /tmp/VBeQtQfmgh (PID: 6247)Socket: 0.0.0.0::0
          Source: /tmp/VBeQtQfmgh (PID: 6247)Socket: 0.0.0.0::80
          Source: /tmp/VBeQtQfmgh (PID: 6247)Socket: 0.0.0.0::81
          Source: /tmp/VBeQtQfmgh (PID: 6247)Socket: 0.0.0.0::8443
          Source: /tmp/VBeQtQfmgh (PID: 6247)Socket: 0.0.0.0::9009
          Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 242.0.40.176
          Source: unknownTCP traffic detected without corresponding DNS query: 207.104.38.176
          Source: unknownTCP traffic detected without corresponding DNS query: 80.149.81.191
          Source: unknownTCP traffic detected without corresponding DNS query: 246.173.169.254
          Source: unknownTCP traffic detected without corresponding DNS query: 130.204.157.39
          Source: unknownTCP traffic detected without corresponding DNS query: 190.195.249.68
          Source: unknownTCP traffic detected without corresponding DNS query: 213.236.72.245
          Source: unknownTCP traffic detected without corresponding DNS query: 204.233.118.138
          Source: unknownTCP traffic detected without corresponding DNS query: 80.65.137.39
          Source: unknownTCP traffic detected without corresponding DNS query: 92.44.167.219
          Source: unknownTCP traffic detected without corresponding DNS query: 57.217.33.64
          Source: unknownTCP traffic detected without corresponding DNS query: 182.105.94.154
          Source: unknownTCP traffic detected without corresponding DNS query: 5.44.7.185
          Source: unknownTCP traffic detected without corresponding DNS query: 119.244.49.234
          Source: unknownTCP traffic detected without corresponding DNS query: 179.244.229.1
          Source: unknownTCP traffic detected without corresponding DNS query: 173.186.225.71
          Source: unknownTCP traffic detected without corresponding DNS query: 39.67.106.113
          Source: unknownTCP traffic detected without corresponding DNS query: 212.62.233.135
          Source: unknownTCP traffic detected without corresponding DNS query: 243.175.32.92
          Source: unknownTCP traffic detected without corresponding DNS query: 4.184.16.160
          Source: unknownTCP traffic detected without corresponding DNS query: 93.120.68.226
          Source: unknownTCP traffic detected without corresponding DNS query: 120.93.222.3
          Source: unknownTCP traffic detected without corresponding DNS query: 24.143.151.136
          Source: unknownTCP traffic detected without corresponding DNS query: 47.31.211.92
          Source: unknownTCP traffic detected without corresponding DNS query: 171.201.64.211
          Source: unknownTCP traffic detected without corresponding DNS query: 222.100.218.22
          Source: unknownTCP traffic detected without corresponding DNS query: 17.230.119.245
          Source: unknownTCP traffic detected without corresponding DNS query: 167.216.231.176
          Source: unknownTCP traffic detected without corresponding DNS query: 101.58.237.46
          Source: unknownTCP traffic detected without corresponding DNS query: 111.202.237.32
          Source: unknownTCP traffic detected without corresponding DNS query: 62.217.236.3
          Source: unknownTCP traffic detected without corresponding DNS query: 223.114.20.235
          Source: unknownTCP traffic detected without corresponding DNS query: 68.61.196.101
          Source: unknownTCP traffic detected without corresponding DNS query: 243.14.57.171
          Source: unknownTCP traffic detected without corresponding DNS query: 113.177.96.195
          Source: unknownTCP traffic detected without corresponding DNS query: 62.56.54.206
          Source: unknownTCP traffic detected without corresponding DNS query: 185.72.72.163
          Source: unknownTCP traffic detected without corresponding DNS query: 40.26.233.34
          Source: unknownTCP traffic detected without corresponding DNS query: 85.96.48.149
          Source: unknownTCP traffic detected without corresponding DNS query: 178.147.100.32
          Source: unknownTCP traffic detected without corresponding DNS query: 183.60.226.92
          Source: unknownTCP traffic detected without corresponding DNS query: 19.73.144.109
          Source: unknownTCP traffic detected without corresponding DNS query: 169.16.51.38
          Source: unknownTCP traffic detected without corresponding DNS query: 18.41.50.12
          Source: unknownTCP traffic detected without corresponding DNS query: 243.43.141.110
          Source: unknownTCP traffic detected without corresponding DNS query: 160.105.106.26
          Source: unknownTCP traffic detected without corresponding DNS query: 109.37.60.227
          Source: unknownTCP traffic detected without corresponding DNS query: 98.70.226.64

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: VBeQtQfmgh, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
          Source: VBeQtQfmgh, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
          Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
          Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
          Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
          Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
          Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
          Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
          Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
          Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
          Contains symbols with names commonly found in malware
          Source: ELF static info symbol of initial sampleName: attack.c
          Source: ELF static info symbol of initial sampleName: attack_app.c
          Source: ELF static info symbol of initial sampleName: attack_app_http
          Source: ELF static info symbol of initial sampleName: attack_get_opt_int
          Source: ELF static info symbol of initial sampleName: attack_get_opt_ip
          Source: ELF static info symbol of initial sampleName: attack_get_opt_str
          Source: ELF static info symbol of initial sampleName: attack_init
          Source: ELF static info symbol of initial sampleName: attack_parse
          Source: ELF static info symbol of initial sampleName: attack_start
          Source: ELF static info symbol of initial sampleName: attack_tcp.c
          Source: VBeQtQfmgh, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
          Source: VBeQtQfmgh, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
          Source: VBeQtQfmgh, type: SAMPLEMatched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
          Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
          Source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
          Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
          Source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
          Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
          Source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
          Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
          Source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
          Source: VBeQtQfmghELF static info symbol of initial sample: __gnu_unwind_execute
          Source: VBeQtQfmghELF static info symbol of initial sample: scanner.c
          Source: VBeQtQfmghELF static info symbol of initial sample: scanner_init
          Source: VBeQtQfmghELF static info symbol of initial sample: scanner_pid
          Source: VBeQtQfmghELF static info symbol of initial sample: scanner_rawpkt
          Source: /tmp/VBeQtQfmgh (PID: 6233)SIGKILL sent: pid: 936, result: successful
          Source: /tmp/VBeQtQfmgh (PID: 6247)SIGKILL sent: pid: 6233, result: successful
          Source: /tmp/VBeQtQfmgh (PID: 6247)SIGKILL sent: pid: 936, result: successful
          Source: /tmp/VBeQtQfmgh (PID: 6247)SIGKILL sent: pid: 759, result: successful
          Source: classification engineClassification label: mal100.troj.evad.lin@0/0@0/0
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/491/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/793/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/772/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/796/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/774/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/797/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/777/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/799/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/658/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/912/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/759/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/936/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/918/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/1/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/761/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/785/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/884/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/720/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/721/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/788/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/789/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/800/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/801/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/847/fd
          Source: /tmp/VBeQtQfmgh (PID: 6233)File opened: /proc/904/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/6233/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/6236/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2033/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2033/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1582/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1582/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2275/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2275/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/6191/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/6191/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/3088/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/6192/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/6192/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1612/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1612/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1579/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1579/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1699/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1699/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1335/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1335/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1698/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1698/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2028/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2028/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1334/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1334/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1576/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1576/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2302/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2302/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/3236/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/3236/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2025/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2025/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2146/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2146/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/910/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/912/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/912/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/912/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/759/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/759/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/759/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/517/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2307/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2307/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/918/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/918/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/918/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1594/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1594/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2285/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2285/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2281/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2281/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1349/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1349/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1623/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1623/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/761/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/761/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/761/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1622/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1622/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/884/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/884/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/884/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1983/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1983/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2038/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/2038/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1586/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1586/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1465/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1465/exe
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1344/fd
          Source: /tmp/VBeQtQfmgh (PID: 6247)File opened: /proc/1344/exe

          Hooking and other Techniques for Hiding and Protection

          barindex
          Sample deletes itself
          Source: /tmp/VBeQtQfmgh (PID: 6229)File: /tmp/VBeQtQfmghJump to behavior
          Uses known network protocols on non-standard ports
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56956
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56960
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56964
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56972
          Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56974
          Source: /tmp/VBeQtQfmgh (PID: 6229)Queries kernel information via 'uname':
          Source: VBeQtQfmgh, 6229.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6233.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6234.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6249.1.00007ffeac865000.00007ffeac886000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/VBeQtQfmghSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/VBeQtQfmgh
          Source: VBeQtQfmgh, 6229.1.0000564b4a401000.0000564b4a554000.rw-.sdmp, VBeQtQfmgh, 6233.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6234.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6249.1.0000564b4a401000.0000564b4a52f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
          Source: VBeQtQfmgh, 6229.1.0000564b4a401000.0000564b4a554000.rw-.sdmp, VBeQtQfmgh, 6233.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6234.1.0000564b4a401000.0000564b4a52f000.rw-.sdmp, VBeQtQfmgh, 6249.1.0000564b4a401000.0000564b4a52f000.rw-.sdmpBinary or memory string: AJKV!/etc/qemu-binfmt/arm
          Source: VBeQtQfmgh, 6229.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6233.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6234.1.00007ffeac865000.00007ffeac886000.rw-.sdmp, VBeQtQfmgh, 6249.1.00007ffeac865000.00007ffeac886000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

          Stealing of Sensitive Information

          barindex
          Yara detected Mirai
          Source: Yara matchFile source: dump.pcap, type: PCAP
          Source: Yara matchFile source: VBeQtQfmgh, type: SAMPLE
          Source: Yara matchFile source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected Mirai
          Source: Yara matchFile source: dump.pcap, type: PCAP
          Source: Yara matchFile source: VBeQtQfmgh, type: SAMPLE
          Source: Yara matchFile source: 6234.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6249.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6229.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6233.1.00007f50f0017000.00007f50f002d000.r-x.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
          Masquerading          		1
          OS Credential Dumping          		11
          Security Software Discovery          		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
          File Deletion          		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
          Non-Standard Port          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
          Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

          Malware Configuration

          ⊘No configs have been found

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679493 Sample: VBeQtQfmgh Startdate: 05/08/2022 Architecture: LINUX Score: 100 25 66.238.202.187 XO-AS15US United States 2->25 27 146.132.148.82 WAL-MARTUS United States 2->27 29 98 other IPs or domains 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 3 other signatures 2->37 8 VBeQtQfmgh 2->8         started        signatures3 process4 signatures5 39 Sample deletes itself 8->39 11 VBeQtQfmgh 8->11         started        13 VBeQtQfmgh 8->13         started        15 VBeQtQfmgh 8->15         started        17 VBeQtQfmgh 8->17         started        process6 process7 19 VBeQtQfmgh 11->19         started        21 VBeQtQfmgh 11->21         started        23 VBeQtQfmgh 11->23         started       

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          VBeQtQfmgh63%VirustotalBrowse
          VBeQtQfmgh100%AviraLINUX/Mirai.bonb

          Dropped Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          ⊘No contacted domains info

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          204.6.82.198
          		unknownUnited States
          		174COGENT-174USfalse
          179.53.118.59
          		unknownDominican Republic
          		6400CompaniaDominicanadeTelefonosSADOfalse
          101.74.50.185
          		unknownChina
          		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
          186.241.56.209
          		unknownBrazil
          		7738TelemarNorteLesteSABRfalse
          17.215.102.114
          		unknownUnited States
          		714APPLE-ENGINEERINGUSfalse
          63.213.192.147
          		unknownUnited States
          		3356LEVEL3USfalse
          38.200.159.254
          		unknownUnited States
          		174COGENT-174USfalse
          200.210.43.141
          		unknownBrazil
          		4230CLAROSABRfalse
          219.157.67.160
          		unknownChina
          		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
          104.121.103.178
          		unknownUnited States
          		16625AKAMAI-ASUSfalse
          136.75.201.58
          		unknownUnited States
          		60311ONEFMCHfalse
          253.76.224.142
          		unknownReserved
          		unknownunknownfalse
          159.182.17.200
          		unknownUnited States
          		11892PEARSON-NAUSfalse
          83.89.235.187
          		unknownDenmark
          		3292TDCTDCASDKfalse
          42.131.165.106
          		unknownChina
          		4249LILLY-ASUSfalse
          37.8.194.18
          		unknownPoland
          		29314VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPLfalse
          201.238.234.107
          		unknownChile
          		14259GtdInternetSACLfalse
          105.19.47.211
          		unknownMauritius
          		37100SEACOM-ASMUfalse
          85.0.181.96
          		unknownSwitzerland
          		3303SWISSCOMSwisscomSwitzerlandLtdCHfalse
          251.6.32.78
          		unknownReserved
          		unknownunknownfalse
          125.131.134.127
          		unknownKorea Republic of
          		4766KIXS-AS-KRKoreaTelecomKRfalse
          159.99.43.101
          		unknownUnited States
          		3371MCI-ASNUSfalse
          197.75.135.242
          		unknownSouth Africa
          		16637MTNNS-ASZAfalse
          165.33.173.211
          		unknownUnited States
          		37053RSAWEB-ASZAfalse
          190.223.30.36
          		unknownPeru
          		12252AmericaMovilPeruSACPEfalse
          16.144.23.142
          		unknownUnited States
          		unknownunknownfalse
          65.81.6.23
          		unknownUnited States
          		6389BELLSOUTH-NET-BLKUSfalse
          170.86.31.158
          		unknownUnited States
          		7726FITC-ASUSfalse
          53.210.90.26
          		unknownGermany
          		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
          87.201.156.198
          		unknownUnited Arab Emirates
          		15802DU-AS1AEfalse
          222.12.115.235
          		unknownJapan2516KDDIKDDICORPORATIONJPfalse
          99.2.98.142
          		unknownUnited States
          		7018ATT-INTERNET4USfalse
          255.94.93.21
          		unknownReserved
          		unknownunknownfalse
          82.82.106.41
          		unknownGermany
          		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
          204.14.230.229
          		unknownUnited States
          		15176AS-INOCUSfalse
          36.33.76.86
          		unknownChina
          		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
          48.188.11.240
          		unknownUnited States
          		2686ATGS-MMD-ASUSfalse
          12.46.36.245
          		unknownUnited States
          		2386INS-ASUSfalse
          105.100.195.38
          		unknownAlgeria
          		36947ALGTEL-ASDZfalse
          73.162.139.51
          		unknownUnited States
          		7922COMCAST-7922USfalse
          84.187.171.97
          		unknownGermany
          		3320DTAGInternetserviceprovideroperationsDEfalse
          207.12.140.72
          		unknownUnited States
          		54321COMPUTEXUSfalse
          2.163.127.40
          		unknownGermany
          		3320DTAGInternetserviceprovideroperationsDEfalse
          255.20.240.50
          		unknownReserved
          		unknownunknownfalse
          106.130.91.13
          		unknownJapan2516KDDIKDDICORPORATIONJPfalse
          248.246.73.133
          		unknownReserved
          		unknownunknownfalse
          186.96.76.234
          		unknownVenezuela
          		28007GoldDataCAVEfalse
          133.226.186.123
          		unknownJapan17958KCVKasaokaCableVisionCoLTDJPfalse
          119.142.224.180
          		unknownChina
          		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
          54.127.156.227
          		unknownUnited States
          		16509AMAZON-02USfalse
          184.6.29.81
          		unknownUnited States
          		209CENTURYLINK-US-LEGACY-QWESTUSfalse
          42.30.124.95
          		unknownKorea Republic of
          		9644SKTELECOM-NET-ASSKTelecomKRfalse
          112.237.193.113
          		unknownChina
          		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
          163.180.209.11
          		unknownKorea Republic of
          		17870KHU-AS-KRKyungHeeUniversityKRfalse
          72.157.207.4
          		unknownUnited States
          		7018ATT-INTERNET4USfalse
          182.248.10.103
          		unknownJapan2516KDDIKDDICORPORATIONJPfalse
          212.103.108.45
          		unknownRussian Federation
          		31585ASN-RAIDRUfalse
          124.73.249.113
          		unknownChina
          		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
          80.41.57.220
          		unknownUnited Kingdom
          		9105TISCALI-UKTalkTalkCommunicationsLimitedGBfalse
          66.182.195.175
          		unknownUnited States
          		20135MTL-19USfalse
          251.94.27.111
          		unknownReserved
          		unknownunknownfalse
          189.254.158.0
          		unknownMexico
          		8151UninetSAdeCVMXfalse
          161.37.102.28
          		unknownSpain
          		158ERI-ASUSfalse
          124.7.137.144
          		unknownIndia
          		9583SIFY-AS-INSifyLimitedINfalse
          86.102.184.24
          		unknownRussian Federation
          		12332PRIMORYE-ASRUfalse
          135.161.31.220
          		unknownUnited States
          		14962NCR-252USfalse
          78.129.59.141
          		unknownBelgium
          		12392ASBRUTELEVOOBEfalse
          104.101.91.162
          		unknownUnited States
          		4818DIGIIX-APDiGiTelecommunicationsSdnBhdMYfalse
          41.35.35.147
          		unknownEgypt
          		8452TE-ASTE-ASEGfalse
          66.238.202.187
          		unknownUnited States
          		2828XO-AS15USfalse
          58.21.171.101
          		unknownChina
          		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
          179.5.202.118
          		unknownEl Salvador
          		14754TelguaGTfalse
          117.103.186.38
          		unknownJapan2914NTT-COMMUNICATIONS-2914USfalse
          247.207.28.159
          		unknownReserved
          		unknownunknownfalse
          205.168.80.8
          		unknownUnited States
          		209CENTURYLINK-US-LEGACY-QWESTUSfalse
          20.104.60.14
          		unknownUnited States
          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
          155.225.196.242
          		unknownUnited States
          		2939SCAROLINA-ASUSfalse
          163.67.45.198
          		unknownFrance
          		17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
          146.132.148.82
          		unknownUnited States
          		10695WAL-MARTUSfalse
          65.189.10.124
          		unknownUnited States
          		10796TWC-10796-MIDWESTUSfalse
          216.96.131.232
          		unknownUnited States
          		3450UTKUSfalse
          210.188.193.23
          		unknownJapan9371SAKURA-CSAKURAInternetIncJPfalse
          240.52.250.93
          		unknownReserved
          		unknownunknownfalse
          252.80.61.190
          		unknownReserved
          		unknownunknownfalse
          152.79.211.5
          		unknownUnited States
          		6192UCDAVIS-COREUSfalse
          159.21.68.141
          		unknownUnited States
          		62195MWH-UK-ASGBfalse
          181.102.35.153
          		unknownArgentina
          		7303TelecomArgentinaSAARfalse
          14.255.165.255
          		unknownViet Nam
          		45899VNPT-AS-VNVNPTCorpVNfalse
          208.43.78.252
          		unknownUnited States
          		36351SOFTLAYERUSfalse
          180.117.121.174
          		unknownChina
          		137702CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvincefalse
          13.121.229.31
          		unknownUnited States
          		16509AMAZON-02USfalse
          99.11.56.165
          		unknownUnited States
          		7018ATT-INTERNET4USfalse
          160.18.158.247
          		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
          216.192.110.227
          		unknownUnited States
          		17184ATL-CBEYONDUSfalse
          178.40.197.55
          		unknownSlovakia (SLOVAK Republic)
          		6855SK-TELEKOMSKfalse
          100.201.253.252
          		unknownUnited States
          		21928T-MOBILE-AS21928USfalse
          5.151.151.65
          		unknownUnited Kingdom
          		42689GLIDEGBfalse
          158.198.222.44
          		unknownJapan17511OPTAGEOPTAGEIncJPfalse
          135.17.183.214
          		unknownUnited States
          		8983NOKIA-ASFIfalse
          98.42.30.235
          		unknownUnited States
          		7922COMCAST-7922USfalse

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
          Entropy (8bit):5.980867024831317
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:VBeQtQfmgh
          File size:138499
          MD5:147b877d92cb69a4f47a6d6c9e4481db
          SHA1:c37890898f0faef6f92fe1cd2506bf11be2fcf75
          SHA256:323eb2ac9034ac59a744a4743f3de35307a4a05a24af0cf75b89bf17ff8d0d6d
          SHA512:9087a3a2045affe99a5346185b864e933e39164288c15b885f567355f2b009dd93d2a71fa6c55264878582c9c68ee65cd0a43ecc1fec44ef24ca7ca8f28decf6
          SSDEEP:3072:53Auz6OTbehLh+BElUCpI3SQeTz+O0IXuGYM/9gY457m:53AuzrTCh6CpI3SPTyIXu5M/9gY457m
          TLSH:90D33B86FB409A13C0D61B77FA9F424933229B54E3DB73068D185FF43F86A9A4E23509
          File Content Preview:.ELF..............(.........4...x.......4. ...(........plP..l...l....................................Q...Q...............Q...Q...Q.......5...............Q...Q...Q..................Q.td..................................-...L..................@-.,@...0....S

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:ARM
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x8194
          Flags:0x4000002
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:5
          Section Header Offset:110968
          Section Header Size:40
          Number of Section Headers:29
          Header String Table Index:26

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x80d40xd40x100x00x6AX004
          .textPROGBITS0x80f00xf00x143f80x00x6AX0016
          .finiPROGBITS0x1c4e80x144e80x100x00x6AX004
          .rodataPROGBITS0x1c4f80x144f80xb5c0x00x2A004
          .ARM.extabPROGBITS0x1d0540x150540x180x00x2A004
          .ARM.exidxARM_EXIDX0x1d06c0x1506c0x1180x00x82AL204
          .eh_framePROGBITS0x251840x151840x40x00x3WA004
          .tbssNOBITS0x251880x151880x80x00x403WAT004
          .init_arrayINIT_ARRAY0x251880x151880x40x00x3WA004
          .fini_arrayFINI_ARRAY0x2518c0x1518c0x40x00x3WA004
          .jcrPROGBITS0x251900x151900x40x00x3WA004
          .gotPROGBITS0x251940x151940xa80x40x3WA004
          .dataPROGBITS0x2523c0x1523c0x2040x00x3WA004
          .bssNOBITS0x254400x154400x330c0x00x3WA004
          .commentPROGBITS0x00x154400x94c0x00x0001
          .debug_arangesPROGBITS0x00x15d900xc00x00x0008
          .debug_pubnamesPROGBITS0x00x15e500x2130x00x0001
          .debug_infoPROGBITS0x00x160630x1d230x00x0001
          .debug_abbrevPROGBITS0x00x17d860x6920x00x0001
          .debug_linePROGBITS0x00x184180x9c70x00x0001
          .debug_framePROGBITS0x00x18de00x2b80x00x0004
          .debug_strPROGBITS0x00x190980x8ca0x10x30MS001
          .debug_locPROGBITS0x00x199620x118f0x00x0001
          .debug_rangesPROGBITS0x00x1aaf10x5580x00x0001
          .ARM.attributesARM_ATTRIBUTES0x00x1b0490x160x00x0001
          .shstrtabSTRTAB0x00x1b05f0x1170x00x0001
          .symtabSYMTAB0x00x1b6000x44f00x100x0286354
          .strtabSTRTAB0x00x1faf00x22130x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          EXIDX0x1506c0x1d06c0x1d06c0x1180x1184.46880x4R 0x4.ARM.exidx
          LOAD0x00x80000x80000x151840x151846.06760x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
          LOAD0x151840x251840x251840x2bc0x35c83.91860x6RW 0x8000.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
          TLS0x151880x251880x251880x00x80.00000x4R 0x4.tbss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

          Symbols

          NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
          .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          .symtab0x80d40SECTION<unknown>DEFAULT1
          .symtab0x80f00SECTION<unknown>DEFAULT2
          .symtab0x1c4e80SECTION<unknown>DEFAULT3
          .symtab0x1c4f80SECTION<unknown>DEFAULT4
          .symtab0x1d0540SECTION<unknown>DEFAULT5
          .symtab0x1d06c0SECTION<unknown>DEFAULT6
          .symtab0x251840SECTION<unknown>DEFAULT7
          .symtab0x251880SECTION<unknown>DEFAULT8
          .symtab0x251880SECTION<unknown>DEFAULT9
          .symtab0x2518c0SECTION<unknown>DEFAULT10
          .symtab0x251900SECTION<unknown>DEFAULT11
          .symtab0x251940SECTION<unknown>DEFAULT12
          .symtab0x2523c0SECTION<unknown>DEFAULT13
          .symtab0x254400SECTION<unknown>DEFAULT14
          .symtab0x00SECTION<unknown>DEFAULT15
          .symtab0x00SECTION<unknown>DEFAULT16
          .symtab0x00SECTION<unknown>DEFAULT17
          .symtab0x00SECTION<unknown>DEFAULT18
          .symtab0x00SECTION<unknown>DEFAULT19
          .symtab0x00SECTION<unknown>DEFAULT20
          .symtab0x00SECTION<unknown>DEFAULT21
          .symtab0x00SECTION<unknown>DEFAULT22
          .symtab0x00SECTION<unknown>DEFAULT23
          .symtab0x00SECTION<unknown>DEFAULT24
          .symtab0x00SECTION<unknown>DEFAULT25
          $a.symtab0x80d40NOTYPE<unknown>DEFAULT1
          $a.symtab0x1c4e80NOTYPE<unknown>DEFAULT3
          $a.symtab0x80e00NOTYPE<unknown>DEFAULT1
          $a.symtab0x1c4f40NOTYPE<unknown>DEFAULT3
          $a.symtab0x80f00NOTYPE<unknown>DEFAULT2
          $a.symtab0x81340NOTYPE<unknown>DEFAULT2
          $a.symtab0x81940NOTYPE<unknown>DEFAULT2
          $a.symtab0x81d00NOTYPE<unknown>DEFAULT2
          $a.symtab0x85240NOTYPE<unknown>DEFAULT2
          $a.symtab0x90500NOTYPE<unknown>DEFAULT2
          $a.symtab0xa1400NOTYPE<unknown>DEFAULT2
          $a.symtab0xa19c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xa2980NOTYPE<unknown>DEFAULT2
          $a.symtab0xa4b40NOTYPE<unknown>DEFAULT2
          $a.symtab0xa5200NOTYPE<unknown>DEFAULT2
          $a.symtab0xa5900NOTYPE<unknown>DEFAULT2
          $a.symtab0xa7e40NOTYPE<unknown>DEFAULT2
          $a.symtab0xaedc0NOTYPE<unknown>DEFAULT2
          $a.symtab0xb5880NOTYPE<unknown>DEFAULT2
          $a.symtab0xb8280NOTYPE<unknown>DEFAULT2
          $a.symtab0xbc600NOTYPE<unknown>DEFAULT2
          $a.symtab0xc3140NOTYPE<unknown>DEFAULT2
          $a.symtab0xc5bc0NOTYPE<unknown>DEFAULT2
          $a.symtab0xc63c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xc68c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xc7300NOTYPE<unknown>DEFAULT2
          $a.symtab0xcc980NOTYPE<unknown>DEFAULT2
          $a.symtab0xda380NOTYPE<unknown>DEFAULT2
          $a.symtab0xe17c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xe1940NOTYPE<unknown>DEFAULT2
          $a.symtab0xe2f40NOTYPE<unknown>DEFAULT2
          $a.symtab0xe33c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xe42c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xead80NOTYPE<unknown>DEFAULT2
          $a.symtab0xeb340NOTYPE<unknown>DEFAULT2
          $a.symtab0xeb9c0NOTYPE<unknown>DEFAULT2
          $a.symtab0xec780NOTYPE<unknown>DEFAULT2
          $a.symtab0xed400NOTYPE<unknown>DEFAULT2
          $a.symtab0xeea00NOTYPE<unknown>DEFAULT2
          $a.symtab0xef9c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x112340NOTYPE<unknown>DEFAULT2
          $a.symtab0x11c600NOTYPE<unknown>DEFAULT2
          $a.symtab0x11e7c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x11ea00NOTYPE<unknown>DEFAULT2
          $a.symtab0x11f400NOTYPE<unknown>DEFAULT2
          $a.symtab0x11fe00NOTYPE<unknown>DEFAULT2
          $a.symtab0x12e600NOTYPE<unknown>DEFAULT2
          $a.symtab0x12e880NOTYPE<unknown>DEFAULT2
          $a.symtab0x12ed00NOTYPE<unknown>DEFAULT2
          $a.symtab0x12ef40NOTYPE<unknown>DEFAULT2
          $a.symtab0x12f180NOTYPE<unknown>DEFAULT2
          $a.symtab0x12f840NOTYPE<unknown>DEFAULT2
          $a.symtab0x130c00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1311c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x131b00NOTYPE<unknown>DEFAULT2
          $a.symtab0x132400NOTYPE<unknown>DEFAULT2
          $a.symtab0x132c00NOTYPE<unknown>DEFAULT2
          $a.symtab0x133540NOTYPE<unknown>DEFAULT2
          $a.symtab0x134500NOTYPE<unknown>DEFAULT2
          $a.symtab0x135640NOTYPE<unknown>DEFAULT2
          $a.symtab0x136a80NOTYPE<unknown>DEFAULT2
          $a.symtab0x136bc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x137540NOTYPE<unknown>DEFAULT2
          $a.symtab0x138480NOTYPE<unknown>DEFAULT2
          $a.symtab0x1385c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1393c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x139740NOTYPE<unknown>DEFAULT2
          $a.symtab0x139b40NOTYPE<unknown>DEFAULT2
          $a.symtab0x139f80NOTYPE<unknown>DEFAULT2
          $a.symtab0x13a7c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x13abc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x13b480NOTYPE<unknown>DEFAULT2
          $a.symtab0x13b780NOTYPE<unknown>DEFAULT2
          $a.symtab0x13bb80NOTYPE<unknown>DEFAULT2
          $a.symtab0x13cc80NOTYPE<unknown>DEFAULT2
          $a.symtab0x13d980NOTYPE<unknown>DEFAULT2
          $a.symtab0x13e5c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x13f0c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x13ff40NOTYPE<unknown>DEFAULT2
          $a.symtab0x140140NOTYPE<unknown>DEFAULT2
          $a.symtab0x140480NOTYPE<unknown>DEFAULT2
          $a.symtab0x140b00NOTYPE<unknown>DEFAULT2
          $a.symtab0x140c00NOTYPE<unknown>DEFAULT2
          $a.symtab0x140d00NOTYPE<unknown>DEFAULT2
          $a.symtab0x141700NOTYPE<unknown>DEFAULT2
          $a.symtab0x141980NOTYPE<unknown>DEFAULT2
          $a.symtab0x141dc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x142200NOTYPE<unknown>DEFAULT2
          $a.symtab0x142940NOTYPE<unknown>DEFAULT2
          $a.symtab0x142d80NOTYPE<unknown>DEFAULT2
          $a.symtab0x143200NOTYPE<unknown>DEFAULT2
          $a.symtab0x143600NOTYPE<unknown>DEFAULT2
          $a.symtab0x143a40NOTYPE<unknown>DEFAULT2
          $a.symtab0x144140NOTYPE<unknown>DEFAULT2
          $a.symtab0x1445c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x144e40NOTYPE<unknown>DEFAULT2
          $a.symtab0x145280NOTYPE<unknown>DEFAULT2
          $a.symtab0x145980NOTYPE<unknown>DEFAULT2
          $a.symtab0x145e40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1466c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x146b40NOTYPE<unknown>DEFAULT2
          $a.symtab0x146f80NOTYPE<unknown>DEFAULT2
          $a.symtab0x147480NOTYPE<unknown>DEFAULT2
          $a.symtab0x1475c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x148200NOTYPE<unknown>DEFAULT2
          $a.symtab0x1488c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1523c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1537c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1573c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x15bdc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x15c1c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x15d440NOTYPE<unknown>DEFAULT2
          $a.symtab0x15d5c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x15e000NOTYPE<unknown>DEFAULT2
          $a.symtab0x15eb80NOTYPE<unknown>DEFAULT2
          $a.symtab0x15f780NOTYPE<unknown>DEFAULT2
          $a.symtab0x1601c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x160ac0NOTYPE<unknown>DEFAULT2
          $a.symtab0x161840NOTYPE<unknown>DEFAULT2
          $a.symtab0x1627c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x163680NOTYPE<unknown>DEFAULT2
          $a.symtab0x163880NOTYPE<unknown>DEFAULT2
          $a.symtab0x163a40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1657c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x166400NOTYPE<unknown>DEFAULT2
          $a.symtab0x1678c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x16db00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1717c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x172140NOTYPE<unknown>DEFAULT2
          $a.symtab0x1725c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1734c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x174840NOTYPE<unknown>DEFAULT2
          $a.symtab0x174dc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x174e40NOTYPE<unknown>DEFAULT2
          $a.symtab0x175140NOTYPE<unknown>DEFAULT2
          $a.symtab0x1756c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x175740NOTYPE<unknown>DEFAULT2
          $a.symtab0x175a40NOTYPE<unknown>DEFAULT2
          $a.symtab0x175fc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x176040NOTYPE<unknown>DEFAULT2
          $a.symtab0x176340NOTYPE<unknown>DEFAULT2
          $a.symtab0x1768c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x176940NOTYPE<unknown>DEFAULT2
          $a.symtab0x176c00NOTYPE<unknown>DEFAULT2
          $a.symtab0x177480NOTYPE<unknown>DEFAULT2
          $a.symtab0x178240NOTYPE<unknown>DEFAULT2
          $a.symtab0x178e40NOTYPE<unknown>DEFAULT2
          $a.symtab0x179380NOTYPE<unknown>DEFAULT2
          $a.symtab0x179900NOTYPE<unknown>DEFAULT2
          $a.symtab0x17d7c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x17df80NOTYPE<unknown>DEFAULT2
          $a.symtab0x17e240NOTYPE<unknown>DEFAULT2
          $a.symtab0x17eac0NOTYPE<unknown>DEFAULT2
          $a.symtab0x17eb40NOTYPE<unknown>DEFAULT2
          $a.symtab0x17ec00NOTYPE<unknown>DEFAULT2
          $a.symtab0x17ed00NOTYPE<unknown>DEFAULT2
          $a.symtab0x17ee00NOTYPE<unknown>DEFAULT2
          $a.symtab0x17f200NOTYPE<unknown>DEFAULT2
          $a.symtab0x17f880NOTYPE<unknown>DEFAULT2
          $a.symtab0x17fec0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1808c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x180b80NOTYPE<unknown>DEFAULT2
          $a.symtab0x180cc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x180e00NOTYPE<unknown>DEFAULT2
          $a.symtab0x180f40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1811c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x181540NOTYPE<unknown>DEFAULT2
          $a.symtab0x181940NOTYPE<unknown>DEFAULT2
          $a.symtab0x181a80NOTYPE<unknown>DEFAULT2
          $a.symtab0x181ec0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1822c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1826c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x182cc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1830c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x183780NOTYPE<unknown>DEFAULT2
          $a.symtab0x1838c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x185040NOTYPE<unknown>DEFAULT2
          $a.symtab0x185f00NOTYPE<unknown>DEFAULT2
          $a.symtab0x189940NOTYPE<unknown>DEFAULT2
          $a.symtab0x18cc40NOTYPE<unknown>DEFAULT2
          $a.symtab0x18ce40NOTYPE<unknown>DEFAULT2
          $a.symtab0x191440NOTYPE<unknown>DEFAULT2
          $a.symtab0x191c40NOTYPE<unknown>DEFAULT2
          $a.symtab0x193280NOTYPE<unknown>DEFAULT2
          $a.symtab0x193580NOTYPE<unknown>DEFAULT2
          $a.symtab0x1949c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x195b80NOTYPE<unknown>DEFAULT2
          $a.symtab0x198680NOTYPE<unknown>DEFAULT2
          $a.symtab0x19c140NOTYPE<unknown>DEFAULT2
          $a.symtab0x19d400NOTYPE<unknown>DEFAULT2
          $a.symtab0x19de00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a2700NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a2900NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a2f00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a3e00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a4cc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a5100NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a5600NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a5ac0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a5d00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a64c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a7440NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a7bc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1a8240NOTYPE<unknown>DEFAULT2
          $a.symtab0x1aa780NOTYPE<unknown>DEFAULT2
          $a.symtab0x1aa840NOTYPE<unknown>DEFAULT2
          $a.symtab0x1aabc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1ab140NOTYPE<unknown>DEFAULT2
          $a.symtab0x1ab6c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1ab780NOTYPE<unknown>DEFAULT2
          $a.symtab0x1acc00NOTYPE<unknown>DEFAULT2
          $a.symtab0x1ad180NOTYPE<unknown>DEFAULT2
          $a.symtab0x1adf40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1ae240NOTYPE<unknown>DEFAULT2
          $a.symtab0x1aec80NOTYPE<unknown>DEFAULT2
          $a.symtab0x1aeec0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1af2c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1af9c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1afe80NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b0340NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b03c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b0400NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b06c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b0780NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b0840NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b2a40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b3f40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b4100NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b4700NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b4dc0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b5940NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b5b40NOTYPE<unknown>DEFAULT2
          $a.symtab0x1b6f80NOTYPE<unknown>DEFAULT2
          $a.symtab0x1bc400NOTYPE<unknown>DEFAULT2
          $a.symtab0x1bc480NOTYPE<unknown>DEFAULT2
          $a.symtab0x1bc500NOTYPE<unknown>DEFAULT2
          $a.symtab0x1bc580NOTYPE<unknown>DEFAULT2
          $a.symtab0x1bd140NOTYPE<unknown>DEFAULT2
          $a.symtab0x1bd580NOTYPE<unknown>DEFAULT2
          $a.symtab0x1c46c0NOTYPE<unknown>DEFAULT2
          $a.symtab0x1c4b40NOTYPE<unknown>DEFAULT2
          $d.symtab0x81280NOTYPE<unknown>DEFAULT2
          $d.symtab0x2518c0NOTYPE<unknown>DEFAULT10
          $d.symtab0x81800NOTYPE<unknown>DEFAULT2
          $d.symtab0x251880NOTYPE<unknown>DEFAULT9
          $d.symtab0x81c40NOTYPE<unknown>DEFAULT2
          $d.symtab0x84e80NOTYPE<unknown>DEFAULT2
          $d.symtab0x90100NOTYPE<unknown>DEFAULT2
          $d.symtab0xa2900NOTYPE<unknown>DEFAULT2
          $d.symtab0xa7c00NOTYPE<unknown>DEFAULT2
          $d.symtab0xaed80NOTYPE<unknown>DEFAULT2
          $d.symtab0xb5840NOTYPE<unknown>DEFAULT2
          $d.symtab0xbc5c0NOTYPE<unknown>DEFAULT2
          $d.symtab0xc3100NOTYPE<unknown>DEFAULT2
          $d.symtab0xcc900NOTYPE<unknown>DEFAULT2
          $d.symtab0xe16c0NOTYPE<unknown>DEFAULT2
          $d.symtab0xe18c0NOTYPE<unknown>DEFAULT2
          $d.symtab0xe2e80NOTYPE<unknown>DEFAULT2
          $d.symtab0xe3340NOTYPE<unknown>DEFAULT2
          $d.symtab0xe4280NOTYPE<unknown>DEFAULT2
          $d.symtab0xeaa80NOTYPE<unknown>DEFAULT2
          $d.symtab0x2523c0NOTYPE<unknown>DEFAULT13
          $d.symtab0x252400NOTYPE<unknown>DEFAULT13
          $d.symtab0x252440NOTYPE<unknown>DEFAULT13
          $d.symtab0x252480NOTYPE<unknown>DEFAULT13
          $d.symtab0xeb240NOTYPE<unknown>DEFAULT2
          $d.symtab0xeb8c0NOTYPE<unknown>DEFAULT2
          $d.symtab0xec680NOTYPE<unknown>DEFAULT2
          $d.symtab0xed3c0NOTYPE<unknown>DEFAULT2
          $d.symtab0xee940NOTYPE<unknown>DEFAULT2
          $d.symtab0xeee80NOTYPE<unknown>DEFAULT2
          $d.symtab0x112100NOTYPE<unknown>DEFAULT2
          $d.symtab0x11c2c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1c70b0NOTYPE<unknown>DEFAULT4
          $d.symtab0x1c7140NOTYPE<unknown>DEFAULT4
          $d.symtab0x11e9c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x11f380NOTYPE<unknown>DEFAULT2
          $d.symtab0x11fd80NOTYPE<unknown>DEFAULT2
          $d.symtab0x12d000NOTYPE<unknown>DEFAULT2
          $d.symtab0x2524c0NOTYPE<unknown>DEFAULT13
          $d.symtab0x00NOTYPE<unknown>DEFAULT21
          $d.symtab0x200NOTYPE<unknown>DEFAULT21
          $d.symtab0x260NOTYPE<unknown>DEFAULT21
          $d.symtab0x2c0NOTYPE<unknown>DEFAULT21
          $d.symtab0x4c0NOTYPE<unknown>DEFAULT21
          $d.symtab0x530NOTYPE<unknown>DEFAULT21
          $d.symtab0x1374c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x138380NOTYPE<unknown>DEFAULT2
          $d.symtab0x1392c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x139700NOTYPE<unknown>DEFAULT2
          $d.symtab0x139b00NOTYPE<unknown>DEFAULT2
          $d.symtab0x139f40NOTYPE<unknown>DEFAULT2
          $d.symtab0x13a740NOTYPE<unknown>DEFAULT2
          $d.symtab0x13ab80NOTYPE<unknown>DEFAULT2
          $d.symtab0x13b440NOTYPE<unknown>DEFAULT2
          $d.symtab0x13bb40NOTYPE<unknown>DEFAULT2
          $d.symtab0x13cac0NOTYPE<unknown>DEFAULT2
          $d.symtab0x13d900NOTYPE<unknown>DEFAULT2
          $d.symtab0x13e500NOTYPE<unknown>DEFAULT2
          $d.symtab0x13f040NOTYPE<unknown>DEFAULT2
          $d.symtab0x1cc7c0NOTYPE<unknown>DEFAULT4
          $d.symtab0x13fe00NOTYPE<unknown>DEFAULT2
          $d.symtab0x140100NOTYPE<unknown>DEFAULT2
          $d.symtab0x140440NOTYPE<unknown>DEFAULT2
          $d.symtab0x140a00NOTYPE<unknown>DEFAULT2
          $d.symtab0x141d40NOTYPE<unknown>DEFAULT2
          $d.symtab0x142180NOTYPE<unknown>DEFAULT2
          $d.symtab0x1428c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x142d00NOTYPE<unknown>DEFAULT2
          $d.symtab0x143180NOTYPE<unknown>DEFAULT2
          $d.symtab0x1435c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1439c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1440c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x144580NOTYPE<unknown>DEFAULT2
          $d.symtab0x144dc0NOTYPE<unknown>DEFAULT2
          $d.symtab0x145200NOTYPE<unknown>DEFAULT2
          $d.symtab0x145900NOTYPE<unknown>DEFAULT2
          $d.symtab0x145dc0NOTYPE<unknown>DEFAULT2
          $d.symtab0x146640NOTYPE<unknown>DEFAULT2
          $d.symtab0x146ac0NOTYPE<unknown>DEFAULT2
          $d.symtab0x146f00NOTYPE<unknown>DEFAULT2
          $d.symtab0x147440NOTYPE<unknown>DEFAULT2
          $d.symtab0x148140NOTYPE<unknown>DEFAULT2
          $d.symtab0x152180NOTYPE<unknown>DEFAULT2
          $d.symtab0x252500NOTYPE<unknown>DEFAULT13
          $d.symtab0x153600NOTYPE<unknown>DEFAULT2
          $d.symtab0x1571c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x15bc00NOTYPE<unknown>DEFAULT2
          $d.symtab0x15c140NOTYPE<unknown>DEFAULT2
          $d.symtab0x15d300NOTYPE<unknown>DEFAULT2
          $d.symtab0x252680NOTYPE<unknown>DEFAULT13
          $d.symtab0x15de40NOTYPE<unknown>DEFAULT2
          $d.symtab0x15e9c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x15f5c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x160000NOTYPE<unknown>DEFAULT2
          $d.symtab0x252800NOTYPE<unknown>DEFAULT13
          $d.symtab0x253180NOTYPE<unknown>DEFAULT13
          $d.symtab0x160a80NOTYPE<unknown>DEFAULT2
          $d.symtab0x161780NOTYPE<unknown>DEFAULT2
          $d.symtab0x1626c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1635c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1cc940NOTYPE<unknown>DEFAULT4
          $d.symtab0x1656c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x166200NOTYPE<unknown>DEFAULT2
          $d.symtab0x2532c0NOTYPE<unknown>DEFAULT13
          $d.symtab0x167680NOTYPE<unknown>DEFAULT2
          $d.symtab0x16d840NOTYPE<unknown>DEFAULT2
          $d.symtab0x171540NOTYPE<unknown>DEFAULT2
          $d.symtab0x173400NOTYPE<unknown>DEFAULT2
          $d.symtab0x1746c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x174800NOTYPE<unknown>DEFAULT2
          $d.symtab0x175100NOTYPE<unknown>DEFAULT2
          $d.symtab0x175a00NOTYPE<unknown>DEFAULT2
          $d.symtab0x176300NOTYPE<unknown>DEFAULT2
          $d.symtab0x1781c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x178d00NOTYPE<unknown>DEFAULT2
          $d.symtab0x179300NOTYPE<unknown>DEFAULT2
          $d.symtab0x179840NOTYPE<unknown>DEFAULT2
          $d.symtab0x17d300NOTYPE<unknown>DEFAULT2
          $d.symtab0x253440NOTYPE<unknown>DEFAULT13
          $d.symtab0x17df00NOTYPE<unknown>DEFAULT2
          $d.symtab0x17e200NOTYPE<unknown>DEFAULT2
          $d.symtab0x17ea00NOTYPE<unknown>DEFAULT2
          $d.symtab0x17f1c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x17f800NOTYPE<unknown>DEFAULT2
          $d.symtab0x17fe80NOTYPE<unknown>DEFAULT2
          $d.symtab0x180880NOTYPE<unknown>DEFAULT2
          $d.symtab0x181140NOTYPE<unknown>DEFAULT2
          $d.symtab0x181500NOTYPE<unknown>DEFAULT2
          $d.symtab0x181900NOTYPE<unknown>DEFAULT2
          $d.symtab0x181e80NOTYPE<unknown>DEFAULT2
          $d.symtab0x182280NOTYPE<unknown>DEFAULT2
          $d.symtab0x182680NOTYPE<unknown>DEFAULT2
          $d.symtab0x182c40NOTYPE<unknown>DEFAULT2
          $d.symtab0x183080NOTYPE<unknown>DEFAULT2
          $d.symtab0x183700NOTYPE<unknown>DEFAULT2
          $d.symtab0x185dc0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1898c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x18cb40NOTYPE<unknown>DEFAULT2
          $d.symtab0x191100NOTYPE<unknown>DEFAULT2
          $d.symtab0x191b40NOTYPE<unknown>DEFAULT2
          $d.symtab0x1930c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x2535c0NOTYPE<unknown>DEFAULT13
          $d.symtab0x253580NOTYPE<unknown>DEFAULT13
          $d.symtab0x1984c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x19bfc0NOTYPE<unknown>DEFAULT2
          $d.symtab0x19d380NOTYPE<unknown>DEFAULT2
          $d.symtab0x1a3d80NOTYPE<unknown>DEFAULT2
          $d.symtab0x1a4c40NOTYPE<unknown>DEFAULT2
          $d.symtab0x1a6480NOTYPE<unknown>DEFAULT2
          $d.symtab0x1a73c0NOTYPE<unknown>DEFAULT2
          $d.symtab0x1a7a40NOTYPE<unknown>DEFAULT2
          $d.symtab0x1a8140NOTYPE<unknown>DEFAULT2
          $d.symtab0x1aa500NOTYPE<unknown>DEFAULT2
          $d.symtab0x1aab00NOTYPE<unknown>DEFAULT2
          $d.symtab0x1ab600NOTYPE<unknown>DEFAULT2
          $d.symtab0x1acb80NOTYPE<unknown>DEFAULT2
          $d.symtab0x1adf00NOTYPE<unknown>DEFAULT2
          $d.symtab0x1aec40NOTYPE<unknown>DEFAULT2
          $d.symtab0x1af980NOTYPE<unknown>DEFAULT2
          $d.symtab0x1b2880NOTYPE<unknown>DEFAULT2
          $d.symtab0x1bc300NOTYPE<unknown>DEFAULT2
          $d.symtab0x580NOTYPE<unknown>DEFAULT21
          $d.symtab0x00NOTYPE<unknown>DEFAULT23
          $d.symtab0x23c0NOTYPE<unknown>DEFAULT21
          $d.symtab0xe390NOTYPE<unknown>DEFAULT23
          $d.symtab0x253500NOTYPE<unknown>DEFAULT13
          $d.symtab0x1cd220NOTYPE<unknown>DEFAULT4
          C.11.5548.symtab0x1cd0012OBJECT<unknown>DEFAULT4
          C.43.5740.symtab0x1c7143OBJECT<unknown>DEFAULT4
          C.44.5741.symtab0x1c70b9OBJECT<unknown>DEFAULT4
          C.5.5083.symtab0x1cc7c24OBJECT<unknown>DEFAULT4
          C.7.5370.symtab0x1cd0c12OBJECT<unknown>DEFAULT4
          C.7.6109.symtab0x1d04812OBJECT<unknown>DEFAULT4
          C.7.6182.symtab0x1d02412OBJECT<unknown>DEFAULT4
          C.8.6110.symtab0x1d03c12OBJECT<unknown>DEFAULT4
          C.9.6119.symtab0x1d03012OBJECT<unknown>DEFAULT4
          ClearALLBuffer.symtab0xc5bc128FUNC<unknown>DEFAULT2
          LOCAL_ADDR.symtab0x27f7c4OBJECT<unknown>DEFAULT14
          Laligned.symtab0x1a2b80NOTYPE<unknown>DEFAULT2
          Llastword.symtab0x1a2d40NOTYPE<unknown>DEFAULT2
          _Exit.symtab0x17f20104FUNC<unknown>DEFAULT2
          _GLOBAL_OFFSET_TABLE_.symtab0x251940OBJECT<unknown>HIDDEN12
          _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _Unwind_Complete.symtab0x1b03c4FUNC<unknown>HIDDEN2
          _Unwind_DeleteException.symtab0x1b04044FUNC<unknown>HIDDEN2
          _Unwind_ForcedUnwind.symtab0x1bcf036FUNC<unknown>HIDDEN2
          _Unwind_GetCFA.symtab0x1b0348FUNC<unknown>HIDDEN2
          _Unwind_GetDataRelBase.symtab0x1b07812FUNC<unknown>HIDDEN2
          _Unwind_GetLanguageSpecificData.symtab0x1bd1468FUNC<unknown>HIDDEN2
          _Unwind_GetRegionStart.symtab0x1c4b452FUNC<unknown>HIDDEN2
          _Unwind_GetTextRelBase.symtab0x1b06c12FUNC<unknown>HIDDEN2
          _Unwind_RaiseException.symtab0x1bc8436FUNC<unknown>HIDDEN2
          _Unwind_Resume.symtab0x1bca836FUNC<unknown>HIDDEN2
          _Unwind_Resume_or_Rethrow.symtab0x1bccc36FUNC<unknown>HIDDEN2
          _Unwind_VRS_Get.symtab0x1af9c76FUNC<unknown>HIDDEN2
          _Unwind_VRS_Pop.symtab0x1b5b4324FUNC<unknown>HIDDEN2
          _Unwind_VRS_Set.symtab0x1afe876FUNC<unknown>HIDDEN2
          _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_b.symtab0x253504OBJECT<unknown>DEFAULT13
          __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_b_data.symtab0x1cd22768OBJECT<unknown>DEFAULT4
          __EH_FRAME_BEGIN__.symtab0x251840OBJECT<unknown>DEFAULT7
          __FRAME_END__.symtab0x251840OBJECT<unknown>DEFAULT7
          __GI___C_ctype_b.symtab0x253504OBJECT<unknown>HIDDEN13
          __GI___close.symtab0x174a0100FUNC<unknown>HIDDEN2
          __GI___close_nocancel.symtab0x1748424FUNC<unknown>HIDDEN2
          __GI___ctype_b.symtab0x253544OBJECT<unknown>HIDDEN13
          __GI___errno_location.symtab0x13ff432FUNC<unknown>HIDDEN2
          __GI___fcntl_nocancel.symtab0x136bc152FUNC<unknown>HIDDEN2
          __GI___fgetc_unlocked.symtab0x19c14300FUNC<unknown>HIDDEN2
          __GI___libc_close.symtab0x174a0100FUNC<unknown>HIDDEN2
          __GI___libc_fcntl.symtab0x13754244FUNC<unknown>HIDDEN2
          __GI___libc_open.symtab0x17530100FUNC<unknown>HIDDEN2
          __GI___libc_read.symtab0x17650100FUNC<unknown>HIDDEN2
          __GI___libc_write.symtab0x175c0100FUNC<unknown>HIDDEN2
          __GI___open.symtab0x17530100FUNC<unknown>HIDDEN2
          __GI___open_nocancel.symtab0x1751424FUNC<unknown>HIDDEN2
          __GI___read.symtab0x17650100FUNC<unknown>HIDDEN2
          __GI___read_nocancel.symtab0x1763424FUNC<unknown>HIDDEN2
          __GI___sigaddset.symtab0x1484436FUNC<unknown>HIDDEN2
          __GI___sigdelset.symtab0x1486836FUNC<unknown>HIDDEN2
          __GI___sigismember.symtab0x1482036FUNC<unknown>HIDDEN2
          __GI___uClibc_fini.symtab0x17868124FUNC<unknown>HIDDEN2
          __GI___uClibc_init.symtab0x1793888FUNC<unknown>HIDDEN2
          __GI___write.symtab0x175c0100FUNC<unknown>HIDDEN2
          __GI___write_nocancel.symtab0x175a424FUNC<unknown>HIDDEN2
          __GI__exit.symtab0x17f20104FUNC<unknown>HIDDEN2
          __GI_abort.symtab0x15c1c296FUNC<unknown>HIDDEN2
          __GI_atoi.symtab0x1636832FUNC<unknown>HIDDEN2
          __GI_bind.symtab0x1419868FUNC<unknown>HIDDEN2
          __GI_brk.symtab0x1ab1488FUNC<unknown>HIDDEN2
          __GI_close.symtab0x174a0100FUNC<unknown>HIDDEN2
          __GI_closedir.symtab0x13bb8272FUNC<unknown>HIDDEN2
          __GI_config_close.symtab0x1891852FUNC<unknown>HIDDEN2
          __GI_config_open.symtab0x1894c72FUNC<unknown>HIDDEN2
          __GI_config_read.symtab0x185f0808FUNC<unknown>HIDDEN2
          __GI_connect.symtab0x14220116FUNC<unknown>HIDDEN2
          __GI_exit.symtab0x1657c196FUNC<unknown>HIDDEN2
          __GI_fclose.symtab0x18994816FUNC<unknown>HIDDEN2
          __GI_fcntl.symtab0x13754244FUNC<unknown>HIDDEN2
          __GI_fflush_unlocked.symtab0x19868940FUNC<unknown>HIDDEN2
          __GI_fgetc.symtab0x19358324FUNC<unknown>HIDDEN2
          __GI_fgetc_unlocked.symtab0x19c14300FUNC<unknown>HIDDEN2
          __GI_fgets.symtab0x1949c284FUNC<unknown>HIDDEN2
          __GI_fgets_unlocked.symtab0x19d40160FUNC<unknown>HIDDEN2
          __GI_fopen.symtab0x18cc432FUNC<unknown>HIDDEN2
          __GI_fork.symtab0x16db0972FUNC<unknown>HIDDEN2
          __GI_fstat.symtab0x17f88100FUNC<unknown>HIDDEN2
          __GI_getc_unlocked.symtab0x19c14300FUNC<unknown>HIDDEN2
          __GI_getdtablesize.symtab0x1808c44FUNC<unknown>HIDDEN2
          __GI_getegid.symtab0x180b820FUNC<unknown>HIDDEN2
          __GI_geteuid.symtab0x180cc20FUNC<unknown>HIDDEN2
          __GI_getgid.symtab0x180e020FUNC<unknown>HIDDEN2
          __GI_getpagesize.symtab0x180f440FUNC<unknown>HIDDEN2
          __GI_getpid.symtab0x1721472FUNC<unknown>HIDDEN2
          __GI_getrlimit.symtab0x1811c56FUNC<unknown>HIDDEN2
          __GI_getsockname.symtab0x1429468FUNC<unknown>HIDDEN2
          __GI_gettimeofday.symtab0x1815464FUNC<unknown>HIDDEN2
          __GI_getuid.symtab0x1819420FUNC<unknown>HIDDEN2
          __GI_inet_addr.symtab0x1417040FUNC<unknown>HIDDEN2
          __GI_inet_aton.symtab0x1a64c248FUNC<unknown>HIDDEN2
          __GI_initstate_r.symtab0x16184248FUNC<unknown>HIDDEN2
          __GI_ioctl.symtab0x1385c224FUNC<unknown>HIDDEN2
          __GI_isatty.symtab0x1a5ac36FUNC<unknown>HIDDEN2
          __GI_kill.symtab0x1393c56FUNC<unknown>HIDDEN2
          __GI_listen.symtab0x1432064FUNC<unknown>HIDDEN2
          __GI_lseek64.symtab0x1af2c112FUNC<unknown>HIDDEN2
          __GI_memcpy.symtab0x140b04FUNC<unknown>HIDDEN2
          __GI_memmove.symtab0x140c04FUNC<unknown>HIDDEN2
          __GI_mempcpy.symtab0x1aec836FUNC<unknown>HIDDEN2
          __GI_memset.symtab0x140d0156FUNC<unknown>HIDDEN2
          __GI_mmap.symtab0x17d7c124FUNC<unknown>HIDDEN2
          __GI_mremap.symtab0x181a868FUNC<unknown>HIDDEN2
          __GI_munmap.symtab0x181ec64FUNC<unknown>HIDDEN2
          __GI_nanosleep.symtab0x1826c96FUNC<unknown>HIDDEN2
          __GI_open.symtab0x17530100FUNC<unknown>HIDDEN2
          __GI_opendir.symtab0x13d98196FUNC<unknown>HIDDEN2
          __GI_raise.symtab0x1725c240FUNC<unknown>HIDDEN2
          __GI_random.symtab0x15d5c164FUNC<unknown>HIDDEN2
          __GI_random_r.symtab0x1601c144FUNC<unknown>HIDDEN2
          __GI_read.symtab0x17650100FUNC<unknown>HIDDEN2
          __GI_readdir.symtab0x13f0c232FUNC<unknown>HIDDEN2
          __GI_readdir64.symtab0x18504236FUNC<unknown>HIDDEN2
          __GI_readlink.symtab0x1397464FUNC<unknown>HIDDEN2
          __GI_recv.symtab0x143a4112FUNC<unknown>HIDDEN2
          __GI_recvfrom.symtab0x1445c136FUNC<unknown>HIDDEN2
          __GI_remove.symtab0x14048100FUNC<unknown>HIDDEN2
          __GI_rmdir.symtab0x182cc64FUNC<unknown>HIDDEN2
          __GI_sbrk.symtab0x1830c108FUNC<unknown>HIDDEN2
          __GI_select.symtab0x139f8132FUNC<unknown>HIDDEN2
          __GI_send.symtab0x14528112FUNC<unknown>HIDDEN2
          __GI_sendto.symtab0x145e4136FUNC<unknown>HIDDEN2
          __GI_setsid.symtab0x13a7c64FUNC<unknown>HIDDEN2
          __GI_setsockopt.symtab0x1466c72FUNC<unknown>HIDDEN2
          __GI_setstate_r.symtab0x1627c236FUNC<unknown>HIDDEN2
          __GI_sigaction.symtab0x17e24136FUNC<unknown>HIDDEN2
          __GI_sigaddset.symtab0x146f880FUNC<unknown>HIDDEN2
          __GI_sigemptyset.symtab0x1474820FUNC<unknown>HIDDEN2
          __GI_signal.symtab0x1475c196FUNC<unknown>HIDDEN2
          __GI_sigprocmask.symtab0x13abc140FUNC<unknown>HIDDEN2
          __GI_sleep.symtab0x1734c300FUNC<unknown>HIDDEN2
          __GI_socket.symtab0x146b468FUNC<unknown>HIDDEN2
          __GI_srandom_r.symtab0x160ac216FUNC<unknown>HIDDEN2
          __GI_strchr.symtab0x1a2f0240FUNC<unknown>HIDDEN2
          __GI_strchrnul.symtab0x1a3e0236FUNC<unknown>HIDDEN2
          __GI_strcmp.symtab0x1a27028FUNC<unknown>HIDDEN2
          __GI_strcoll.symtab0x1a27028FUNC<unknown>HIDDEN2
          __GI_strcspn.symtab0x1a4cc68FUNC<unknown>HIDDEN2
          __GI_strlen.symtab0x1a29096FUNC<unknown>HIDDEN2
          __GI_strrchr.symtab0x1a51080FUNC<unknown>HIDDEN2
          __GI_strspn.symtab0x1a56076FUNC<unknown>HIDDEN2
          __GI_strtol.symtab0x1638828FUNC<unknown>HIDDEN2
          __GI_sysconf.symtab0x1678c1572FUNC<unknown>HIDDEN2
          __GI_tcgetattr.symtab0x1a5d0124FUNC<unknown>HIDDEN2
          __GI_time.symtab0x13b4848FUNC<unknown>HIDDEN2
          __GI_times.symtab0x1837820FUNC<unknown>HIDDEN2
          __GI_unlink.symtab0x13b7864FUNC<unknown>HIDDEN2
          __GI_write.symtab0x175c0100FUNC<unknown>HIDDEN2
          __JCR_END__.symtab0x251900OBJECT<unknown>DEFAULT11
          __JCR_LIST__.symtab0x251900OBJECT<unknown>DEFAULT11
          ___Unwind_ForcedUnwind.symtab0x1bcf036FUNC<unknown>HIDDEN2
          ___Unwind_RaiseException.symtab0x1bc8436FUNC<unknown>HIDDEN2
          ___Unwind_Resume.symtab0x1bca836FUNC<unknown>HIDDEN2
          ___Unwind_Resume_or_Rethrow.symtab0x1bccc36FUNC<unknown>HIDDEN2
          __aeabi_idiv.symtab0x135640FUNC<unknown>HIDDEN2
          __aeabi_idivmod.symtab0x1369024FUNC<unknown>HIDDEN2
          __aeabi_read_tp.symtab0x17ed08FUNC<unknown>DEFAULT2
          __aeabi_uidiv.symtab0x134500FUNC<unknown>HIDDEN2
          __aeabi_uidivmod.symtab0x1354c24FUNC<unknown>HIDDEN2
          __aeabi_unwind_cpp_pr0.symtab0x1bc508FUNC<unknown>HIDDEN2
          __aeabi_unwind_cpp_pr1.symtab0x1bc488FUNC<unknown>HIDDEN2
          __aeabi_unwind_cpp_pr2.symtab0x1bc408FUNC<unknown>HIDDEN2
          __app_fini.symtab0x25a144OBJECT<unknown>HIDDEN14
          __atexit_lock.symtab0x2532c24OBJECT<unknown>DEFAULT13
          __bss_end__.symtab0x2874c0NOTYPE<unknown>DEFAULTSHN_ABS
          __bss_start.symtab0x254400NOTYPE<unknown>DEFAULTSHN_ABS
          __bss_start__.symtab0x254400NOTYPE<unknown>DEFAULTSHN_ABS
          __check_one_fd.symtab0x178e484FUNC<unknown>DEFAULT2
          __close.symtab0x174a0100FUNC<unknown>DEFAULT2
          __close_nocancel.symtab0x1748424FUNC<unknown>DEFAULT2
          __ctype_b.symtab0x253544OBJECT<unknown>DEFAULT13
          __curbrk.symtab0x27f784OBJECT<unknown>HIDDEN14
          __cxa_begin_cleanup.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __cxa_call_unexpected.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __cxa_type_match.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __data_start.symtab0x2523c0NOTYPE<unknown>DEFAULT13
          __default_rt_sa_restorer.symtab0x17ec40FUNC<unknown>DEFAULT2
          __default_sa_restorer.symtab0x17eb80FUNC<unknown>DEFAULT2
          __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __div0.symtab0x136a820FUNC<unknown>HIDDEN2
          __divsi3.symtab0x13564300FUNC<unknown>HIDDEN2
          __do_global_dtors_aux.symtab0x80f00FUNC<unknown>DEFAULT2
          __do_global_dtors_aux_fini_array_entry.symtab0x2518c0OBJECT<unknown>DEFAULT10
          __end__.symtab0x2874c0NOTYPE<unknown>DEFAULTSHN_ABS
          __environ.symtab0x25a0c4OBJECT<unknown>DEFAULT14
          __errno_location.symtab0x13ff432FUNC<unknown>DEFAULT2
          __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __exidx_end.symtab0x1d1840NOTYPE<unknown>DEFAULTSHN_ABS
          __exidx_start.symtab0x1d06c0NOTYPE<unknown>DEFAULTSHN_ABS
          __exit_cleanup.symtab0x254bc4OBJECT<unknown>HIDDEN14
          __fcntl_nocancel.symtab0x136bc152FUNC<unknown>DEFAULT2
          __fgetc_unlocked.symtab0x19c14300FUNC<unknown>DEFAULT2
          __fini_array_end.symtab0x251900NOTYPE<unknown>HIDDEN10
          __fini_array_start.symtab0x2518c0NOTYPE<unknown>HIDDEN10
          __fork.symtab0x16db0972FUNC<unknown>DEFAULT2
          __fork_generation_pointer.symtab0x287184OBJECT<unknown>HIDDEN14
          __fork_handlers.symtab0x2871c4OBJECT<unknown>HIDDEN14
          __fork_lock.symtab0x254c04OBJECT<unknown>HIDDEN14
          __frame_dummy_init_array_entry.symtab0x251880OBJECT<unknown>DEFAULT9
          __getdents.symtab0x17fec160FUNC<unknown>HIDDEN2
          __getdents64.symtab0x1ab78328FUNC<unknown>HIDDEN2
          __getpagesize.symtab0x180f440FUNC<unknown>DEFAULT2
          __getpid.symtab0x1721472FUNC<unknown>DEFAULT2
          __gnu_Unwind_Find_exidx.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __gnu_Unwind_ForcedUnwind.symtab0x1b3f428FUNC<unknown>HIDDEN2
          __gnu_Unwind_RaiseException.symtab0x1b4dc184FUNC<unknown>HIDDEN2
          __gnu_Unwind_Restore_VFP.symtab0x1bc740FUNC<unknown>HIDDEN2
          __gnu_Unwind_Resume.symtab0x1b470108FUNC<unknown>HIDDEN2
          __gnu_Unwind_Resume_or_Rethrow.symtab0x1b59432FUNC<unknown>HIDDEN2
          __gnu_Unwind_Save_VFP.symtab0x1bc7c0FUNC<unknown>HIDDEN2
          __gnu_unwind_execute.symtab0x1bd581812FUNC<unknown>HIDDEN2
          __gnu_unwind_frame.symtab0x1c46c72FUNC<unknown>HIDDEN2
          __gnu_unwind_pr_common.symtab0x1b6f81352FUNC<unknown>DEFAULT2
          __h_errno_location.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __init_array_end.symtab0x2518c0NOTYPE<unknown>HIDDEN9
          __init_array_start.symtab0x251880NOTYPE<unknown>HIDDEN9
          __libc_close.symtab0x174a0100FUNC<unknown>DEFAULT2
          __libc_connect.symtab0x14220116FUNC<unknown>DEFAULT2
          __libc_disable_asynccancel.symtab0x176c0136FUNC<unknown>HIDDEN2
          __libc_enable_asynccancel.symtab0x17748220FUNC<unknown>HIDDEN2
          __libc_errno.symtab0x04TLS<unknown>HIDDEN8
          __libc_fcntl.symtab0x13754244FUNC<unknown>DEFAULT2
          __libc_fork.symtab0x16db0972FUNC<unknown>DEFAULT2
          __libc_h_errno.symtab0x44TLS<unknown>HIDDEN8
          __libc_multiple_threads.symtab0x287204OBJECT<unknown>HIDDEN14
          __libc_nanosleep.symtab0x1826c96FUNC<unknown>DEFAULT2
          __libc_open.symtab0x17530100FUNC<unknown>DEFAULT2
          __libc_read.symtab0x17650100FUNC<unknown>DEFAULT2
          __libc_recv.symtab0x143a4112FUNC<unknown>DEFAULT2
          __libc_recvfrom.symtab0x1445c136FUNC<unknown>DEFAULT2
          __libc_select.symtab0x139f8132FUNC<unknown>DEFAULT2
          __libc_send.symtab0x14528112FUNC<unknown>DEFAULT2
          __libc_sendto.symtab0x145e4136FUNC<unknown>DEFAULT2
          __libc_setup_tls.symtab0x1a848560FUNC<unknown>DEFAULT2
          __libc_sigaction.symtab0x17e24136FUNC<unknown>DEFAULT2
          __libc_stack_end.symtab0x25a084OBJECT<unknown>DEFAULT14
          __libc_write.symtab0x175c0100FUNC<unknown>DEFAULT2
          __lll_lock_wait_private.symtab0x1717c152FUNC<unknown>HIDDEN2
          __malloc_consolidate.symtab0x157ec436FUNC<unknown>HIDDEN2
          __malloc_largebin_index.symtab0x1488c120FUNC<unknown>DEFAULT2
          __malloc_lock.symtab0x2525024OBJECT<unknown>DEFAULT13
          __malloc_state.symtab0x283a0888OBJECT<unknown>DEFAULT14
          __malloc_trim.symtab0x1573c176FUNC<unknown>DEFAULT2
          __nptl_deallocate_tsd.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __open.symtab0x17530100FUNC<unknown>DEFAULT2
          __open_nocancel.symtab0x1751424FUNC<unknown>DEFAULT2
          __pagesize.symtab0x25a104OBJECT<unknown>DEFAULT14
          __preinit_array_end.symtab0x251880NOTYPE<unknown>HIDDEN8
          __preinit_array_start.symtab0x251880NOTYPE<unknown>HIDDEN8
          __progname.symtab0x253484OBJECT<unknown>DEFAULT13
          __progname_full.symtab0x2534c4OBJECT<unknown>DEFAULT13
          __pthread_initialize_minimal.symtab0x1aa7812FUNC<unknown>DEFAULT2
          __pthread_mutex_init.symtab0x1782c8FUNC<unknown>DEFAULT2
          __pthread_mutex_lock.symtab0x178248FUNC<unknown>DEFAULT2
          __pthread_mutex_trylock.symtab0x178248FUNC<unknown>DEFAULT2
          __pthread_mutex_unlock.symtab0x178248FUNC<unknown>DEFAULT2
          __pthread_return_0.symtab0x178248FUNC<unknown>DEFAULT2
          __pthread_unwind.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __read.symtab0x17650100FUNC<unknown>DEFAULT2
          __read_nocancel.symtab0x1763424FUNC<unknown>DEFAULT2
          __register_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          __restore_core_regs.symtab0x1bc5828FUNC<unknown>HIDDEN2
          __rtld_fini.symtab0x25a184OBJECT<unknown>HIDDEN14
          __sigaddset.symtab0x1484436FUNC<unknown>DEFAULT2
          __sigdelset.symtab0x1486836FUNC<unknown>DEFAULT2
          __sigismember.symtab0x1482036FUNC<unknown>DEFAULT2
          __sigjmp_save.symtab0x1aeec64FUNC<unknown>HIDDEN2
          __sigsetjmp.symtab0x1ab6c12FUNC<unknown>DEFAULT2
          __stdin.symtab0x253684OBJECT<unknown>DEFAULT13
          __stdio_READ.symtab0x1acc088FUNC<unknown>HIDDEN2
          __stdio_WRITE.symtab0x1ad18220FUNC<unknown>HIDDEN2
          __stdio_rfill.symtab0x1adf448FUNC<unknown>HIDDEN2
          __stdio_trans2r_o.symtab0x1ae24164FUNC<unknown>HIDDEN2
          __stdio_wcommit.symtab0x1932848FUNC<unknown>HIDDEN2
          __stdout.symtab0x2536c4OBJECT<unknown>DEFAULT13
          __sys_connect.symtab0x141dc68FUNC<unknown>DEFAULT2
          __sys_recv.symtab0x1436068FUNC<unknown>DEFAULT2
          __sys_recvfrom.symtab0x1441472FUNC<unknown>DEFAULT2
          __sys_send.symtab0x144e468FUNC<unknown>DEFAULT2
          __sys_sendto.symtab0x1459876FUNC<unknown>DEFAULT2
          __syscall_error.symtab0x17df844FUNC<unknown>HIDDEN2
          __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_nanosleep.symtab0x1822c64FUNC<unknown>DEFAULT2
          __syscall_rt_sigaction.symtab0x17ee064FUNC<unknown>DEFAULT2
          __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_select.symtab0x139b468FUNC<unknown>DEFAULT2
          __tls_get_addr.symtab0x1a82436FUNC<unknown>DEFAULT2
          __uClibc_fini.symtab0x17868124FUNC<unknown>DEFAULT2
          __uClibc_init.symtab0x1793888FUNC<unknown>DEFAULT2
          __uClibc_main.symtab0x179901004FUNC<unknown>DEFAULT2
          __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __uclibc_progname.symtab0x253444OBJECT<unknown>HIDDEN13
          __udivsi3.symtab0x13450252FUNC<unknown>HIDDEN2
          __write.symtab0x175c0100FUNC<unknown>DEFAULT2
          __write_nocancel.symtab0x175a424FUNC<unknown>DEFAULT2
          __xstat32_conv.symtab0x18458172FUNC<unknown>HIDDEN2
          __xstat64_conv.symtab0x1838c204FUNC<unknown>HIDDEN2
          _bss_end__.symtab0x2874c0NOTYPE<unknown>DEFAULTSHN_ABS
          _dl_aux_init.symtab0x1aa8456FUNC<unknown>DEFAULT2
          _dl_nothread_init_static_tls.symtab0x1aabc88FUNC<unknown>HIDDEN2
          _dl_phdr.symtab0x287444OBJECT<unknown>DEFAULT14
          _dl_phnum.symtab0x287484OBJECT<unknown>DEFAULT14
          _dl_tls_dtv_gaps.symtab0x287381OBJECT<unknown>DEFAULT14
          _dl_tls_dtv_slotinfo_list.symtab0x287344OBJECT<unknown>DEFAULT14
          _dl_tls_generation.symtab0x2873c4OBJECT<unknown>DEFAULT14
          _dl_tls_max_dtv_idx.symtab0x2872c4OBJECT<unknown>DEFAULT14
          _dl_tls_setup.symtab0x1a7bc104FUNC<unknown>DEFAULT2
          _dl_tls_static_align.symtab0x287284OBJECT<unknown>DEFAULT14
          _dl_tls_static_nelem.symtab0x287404OBJECT<unknown>DEFAULT14
          _dl_tls_static_size.symtab0x287304OBJECT<unknown>DEFAULT14
          _dl_tls_static_used.symtab0x287244OBJECT<unknown>DEFAULT14
          _edata.symtab0x254400NOTYPE<unknown>DEFAULTSHN_ABS
          _end.symtab0x2874c0NOTYPE<unknown>DEFAULTSHN_ABS
          _exit.symtab0x17f20104FUNC<unknown>DEFAULT2
          _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _fini.symtab0x1c4e80FUNC<unknown>DEFAULT3
          _fixed_buffers.symtab0x25a3c8192OBJECT<unknown>DEFAULT14
          _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _init.symtab0x80d40FUNC<unknown>DEFAULT1
          _memcpy.symtab0x19de00FUNC<unknown>HIDDEN2
          _pthread_cleanup_pop_restore.symtab0x1783c44FUNC<unknown>DEFAULT2
          _pthread_cleanup_push_defer.symtab0x178348FUNC<unknown>DEFAULT2
          _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _setjmp.symtab0x17eac8FUNC<unknown>DEFAULT2
          _sigintr.symtab0x283988OBJECT<unknown>HIDDEN14
          _start.symtab0x81940FUNC<unknown>DEFAULT2
          _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _stdio_fopen.symtab0x18ce41120FUNC<unknown>HIDDEN2
          _stdio_init.symtab0x19144128FUNC<unknown>HIDDEN2
          _stdio_openlist.symtab0x253704OBJECT<unknown>DEFAULT13
          _stdio_openlist_add_lock.symtab0x25a1c12OBJECT<unknown>DEFAULT14
          _stdio_openlist_dec_use.symtab0x195b8688FUNC<unknown>HIDDEN2
          _stdio_openlist_del_count.symtab0x25a384OBJECT<unknown>DEFAULT14
          _stdio_openlist_del_lock.symtab0x25a2812OBJECT<unknown>DEFAULT14
          _stdio_openlist_use_count.symtab0x25a344OBJECT<unknown>DEFAULT14
          _stdio_streams.symtab0x25374204OBJECT<unknown>DEFAULT13
          _stdio_term.symtab0x191c4356FUNC<unknown>HIDDEN2
          _stdio_user_locking.symtab0x253584OBJECT<unknown>DEFAULT13
          _stdlib_strto_l.symtab0x163a4472FUNC<unknown>HIDDEN2
          _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          abort.symtab0x15c1c296FUNC<unknown>DEFAULT2
          abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          add_auth_entry.symtab0xed40352FUNC<unknown>DEFAULT2
          anti_gdb_entry.symtab0xe17c24FUNC<unknown>DEFAULT2
          atoi.symtab0x1636832FUNC<unknown>DEFAULT2
          atol.symtab0x1636832FUNC<unknown>DEFAULT2
          atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          attack.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          attack_app.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          attack_app_http.symtab0x81d08048FUNC<unknown>DEFAULT2
          attack_get_opt_int.symtab0xa520112FUNC<unknown>DEFAULT2
          attack_get_opt_ip.symtab0xa4b4108FUNC<unknown>DEFAULT2
          attack_get_opt_str.symtab0xa14092FUNC<unknown>DEFAULT2
          attack_init.symtab0xa590596FUNC<unknown>DEFAULT2
          attack_parse.symtab0xa298540FUNC<unknown>DEFAULT2
          attack_start.symtab0xa19c252FUNC<unknown>DEFAULT2
          attack_tcp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          attack_tcp_ack.symtab0xa7e41784FUNC<unknown>DEFAULT2
          attack_tcp_syn.symtab0xaedc1708FUNC<unknown>DEFAULT2
          attack_udp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          attack_udp_ovhhex.symtab0xbc601716FUNC<unknown>DEFAULT2
          attack_udp_plain.symtab0xb588672FUNC<unknown>DEFAULT2
          attack_udp_stdhex.symtab0xc314680FUNC<unknown>DEFAULT2
          attack_udp_vse.symtab0xb8281080FUNC<unknown>DEFAULT2
          auth_table.symtab0x254ac4OBJECT<unknown>DEFAULT14
          auth_table_len.symtab0x254804OBJECT<unknown>DEFAULT14
          auth_table_max_weight.symtab0x254b02OBJECT<unknown>DEFAULT14
          been_there_done_that.symtab0x254b84OBJECT<unknown>DEFAULT14
          bind.symtab0x1419868FUNC<unknown>DEFAULT2
          bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          brk.symtab0x1ab1488FUNC<unknown>DEFAULT2
          brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          bsd_signal.symtab0x1475c196FUNC<unknown>DEFAULT2
          buff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          calloc.symtab0x1523c320FUNC<unknown>DEFAULT2
          calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          checksum_generic.symtab0xc63c80FUNC<unknown>DEFAULT2
          checksum_tcpudp.symtab0xc68c164FUNC<unknown>DEFAULT2
          clock.symtab0x1401452FUNC<unknown>DEFAULT2
          clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          close.symtab0x174a0100FUNC<unknown>DEFAULT2
          closedir.symtab0x13bb8272FUNC<unknown>DEFAULT2
          closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          completed.5105.symtab0x254401OBJECT<unknown>DEFAULT14
          conn_table.symtab0x27f984OBJECT<unknown>DEFAULT14
          connect.symtab0x14220116FUNC<unknown>DEFAULT2
          connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          ensure_single_instance.symtab0xe194352FUNC<unknown>DEFAULT2
          environ.symtab0x25a0c4OBJECT<unknown>DEFAULT14
          errno.symtab0x04TLS<unknown>DEFAULT8
          errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          exit.symtab0x1657c196FUNC<unknown>DEFAULT2
          exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fake_time.symtab0x254b44OBJECT<unknown>DEFAULT14
          fclose.symtab0x18994816FUNC<unknown>DEFAULT2
          fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fcntl.symtab0x13754244FUNC<unknown>DEFAULT2
          fd_ctrl.symtab0x2523c4OBJECT<unknown>DEFAULT13
          fd_serv.symtab0x252404OBJECT<unknown>DEFAULT13
          fd_to_DIR.symtab0x13cc8208FUNC<unknown>DEFAULT2
          fdopendir.symtab0x13e5c176FUNC<unknown>DEFAULT2
          fflush_unlocked.symtab0x19868940FUNC<unknown>DEFAULT2
          fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgetc.symtab0x19358324FUNC<unknown>DEFAULT2
          fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgetc_unlocked.symtab0x19c14300FUNC<unknown>DEFAULT2
          fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgets.symtab0x1949c284FUNC<unknown>DEFAULT2
          fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgets_unlocked.symtab0x19d40160FUNC<unknown>DEFAULT2
          fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fopen.symtab0x18cc432FUNC<unknown>DEFAULT2
          fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fork.symtab0x16db0972FUNC<unknown>DEFAULT2
          fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fork_handler_pool.symtab0x254c41348OBJECT<unknown>DEFAULT14
          frame_dummy.symtab0x81340FUNC<unknown>DEFAULT2
          free.symtab0x159a0572FUNC<unknown>DEFAULT2
          free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fstat.symtab0x17f88100FUNC<unknown>DEFAULT2
          fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          get_eit_entry.symtab0x1b084544FUNC<unknown>DEFAULT2
          getc.symtab0x19358324FUNC<unknown>DEFAULT2
          getc_unlocked.symtab0x19c14300FUNC<unknown>DEFAULT2
          getdents.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getdtablesize.symtab0x1808c44FUNC<unknown>DEFAULT2
          getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getegid.symtab0x180b820FUNC<unknown>DEFAULT2
          getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          geteuid.symtab0x180cc20FUNC<unknown>DEFAULT2
          geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getgid.symtab0x180e020FUNC<unknown>DEFAULT2
          getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getpagesize.symtab0x180f440FUNC<unknown>DEFAULT2
          getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getpid.symtab0x1721472FUNC<unknown>DEFAULT2
          getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getppid.symtab0x1384820FUNC<unknown>DEFAULT2
          getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getrlimit.symtab0x1811c56FUNC<unknown>DEFAULT2
          getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getsockname.symtab0x1429468FUNC<unknown>DEFAULT2
          getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getsockopt.symtab0x142d872FUNC<unknown>DEFAULT2
          getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gettimeofday.symtab0x1815464FUNC<unknown>DEFAULT2
          gettimeofday.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getuid.symtab0x1819420FUNC<unknown>DEFAULT2
          getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          h_errno.symtab0x44TLS<unknown>DEFAULT8
          index.symtab0x1a2f0240FUNC<unknown>DEFAULT2
          inet_addr.symtab0x1417040FUNC<unknown>DEFAULT2
          inet_aton.symtab0x1a64c248FUNC<unknown>DEFAULT2
          inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          init_static_tls.symtab0x1a744120FUNC<unknown>DEFAULT2
          initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          initstate.symtab0x15eb8192FUNC<unknown>DEFAULT2
          initstate_r.symtab0x16184248FUNC<unknown>DEFAULT2
          ioctl.symtab0x1385c224FUNC<unknown>DEFAULT2
          ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          isatty.symtab0x1a5ac36FUNC<unknown>DEFAULT2
          isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          kill.symtab0x1393c56FUNC<unknown>DEFAULT2
          kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          killer.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          killer_init.symtab0xda381860FUNC<unknown>DEFAULT2
          killer_kill_by_port.symtab0xc7301384FUNC<unknown>DEFAULT2
          killer_pid.symtab0x27f844OBJECT<unknown>DEFAULT14
          killer_realpath.symtab0x27f804OBJECT<unknown>DEFAULT14
          killer_realpath_len.symtab0x254644OBJECT<unknown>DEFAULT14
          libc-cancellation.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc-lowlevellock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc-tls.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc_multiple_threads.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          listen.symtab0x1432064FUNC<unknown>DEFAULT2
          listen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          local_bind.4765.symtab0x252481OBJECT<unknown>DEFAULT13
          lseek64.symtab0x1af2c112FUNC<unknown>DEFAULT2
          main.symtab0xe42c1708FUNC<unknown>DEFAULT2
          main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          malloc.symtab0x149042360FUNC<unknown>DEFAULT2
          malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          malloc_trim.symtab0x15bdc64FUNC<unknown>DEFAULT2
          memcpy.symtab0x140b04FUNC<unknown>DEFAULT2
          memmove.symtab0x140c04FUNC<unknown>DEFAULT2
          memory_scan_match.symtab0xcc983488FUNC<unknown>DEFAULT2
          mempcpy.symtab0x1aec836FUNC<unknown>DEFAULT2
          mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memset.symtab0x140d0156FUNC<unknown>DEFAULT2
          methods.symtab0x254604OBJECT<unknown>DEFAULT14
          methods_len.symtab0x2545c1OBJECT<unknown>DEFAULT14
          mmap.symtab0x17d7c124FUNC<unknown>DEFAULT2
          mmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          mremap.symtab0x181a868FUNC<unknown>DEFAULT2
          mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          munmap.symtab0x181ec64FUNC<unknown>DEFAULT2
          munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          mylock.symtab0x2526824OBJECT<unknown>DEFAULT13
          mylock.symtab0x2528024OBJECT<unknown>DEFAULT13
          nanosleep.symtab0x1826c96FUNC<unknown>DEFAULT2
          nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          nprocessors_onln.symtab0x16640332FUNC<unknown>DEFAULT2
          object.5113.symtab0x2544424OBJECT<unknown>DEFAULT14
          open.symtab0x17530100FUNC<unknown>DEFAULT2
          opendir.symtab0x13d98196FUNC<unknown>DEFAULT2
          opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          parse_config.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          pending_connection.symtab0x2546c1OBJECT<unknown>DEFAULT14
          pr-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          program_invocation_name.symtab0x2534c4OBJECT<unknown>DEFAULT13
          program_invocation_short_name.symtab0x253484OBJECT<unknown>DEFAULT13
          raise.symtab0x1725c240FUNC<unknown>DEFAULT2
          raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand.symtab0x15d4424FUNC<unknown>DEFAULT2
          rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand_init.symtab0xeb34104FUNC<unknown>DEFAULT2
          rand_next.symtab0xead892FUNC<unknown>DEFAULT2
          rand_str.symtab0xeb9c220FUNC<unknown>DEFAULT2
          random.symtab0x15d5c164FUNC<unknown>DEFAULT2
          random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          random_poly_info.symtab0x1cc9440OBJECT<unknown>DEFAULT4
          random_r.symtab0x1601c144FUNC<unknown>DEFAULT2
          random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          randtbl.symtab0x25298128OBJECT<unknown>DEFAULT13
          read.symtab0x17650100FUNC<unknown>DEFAULT2
          readdir.symtab0x13f0c232FUNC<unknown>DEFAULT2
          readdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          readdir64.symtab0x18504236FUNC<unknown>DEFAULT2
          readdir64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          readlink.symtab0x1397464FUNC<unknown>DEFAULT2
          readlink.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          realloc.symtab0x1537c960FUNC<unknown>DEFAULT2
          realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          recv.symtab0x143a4112FUNC<unknown>DEFAULT2
          recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          recvfrom.symtab0x1445c136FUNC<unknown>DEFAULT2
          recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          register-atfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          remove.symtab0x14048100FUNC<unknown>DEFAULT2
          remove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          resolve_cnc_addr.symtab0xe2f472FUNC<unknown>DEFAULT2
          resolve_func.symtab0x252444OBJECT<unknown>DEFAULT13
          restore_core_regs.symtab0x1bc5828FUNC<unknown>HIDDEN2
          rindex.symtab0x1a51080FUNC<unknown>DEFAULT2
          rmdir.symtab0x182cc64FUNC<unknown>DEFAULT2
          rmdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rsck.symtab0x27f9c4OBJECT<unknown>DEFAULT14
          rsck_out.symtab0x27fa44OBJECT<unknown>DEFAULT14
          sbrk.symtab0x1830c108FUNC<unknown>DEFAULT2
          sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          scanner.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          scanner_init.symtab0xeea012252FUNC<unknown>DEFAULT2
          scanner_pid.symtab0x27fa04OBJECT<unknown>DEFAULT14
          scanner_rawpkt.symtab0x2548440OBJECT<unknown>DEFAULT14
          select.symtab0x139f8132FUNC<unknown>DEFAULT2
          select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          send.symtab0x14528112FUNC<unknown>DEFAULT2
          send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sendto.symtab0x145e4136FUNC<unknown>DEFAULT2
          sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setsid.symtab0x13a7c64FUNC<unknown>DEFAULT2
          setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setsockopt.symtab0x1466c72FUNC<unknown>DEFAULT2
          setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setstate.symtab0x15e00184FUNC<unknown>DEFAULT2
          setstate_r.symtab0x1627c236FUNC<unknown>DEFAULT2
          setup_connection.symtab0xec78200FUNC<unknown>DEFAULT2
          sigaction.symtab0x17e24136FUNC<unknown>DEFAULT2
          sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigaddset.symtab0x146f880FUNC<unknown>DEFAULT2
          sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Aug 5, 2022 21:59:23.337927103 CEST42836443192.168.2.2391.189.91.43
          Aug 5, 2022 21:59:24.106009007 CEST4251680192.168.2.23109.202.202.202
          Aug 5, 2022 21:59:27.747617960 CEST5633823192.168.2.23242.0.40.176
          Aug 5, 2022 21:59:27.747827053 CEST5633823192.168.2.23207.104.38.176
          Aug 5, 2022 21:59:27.747847080 CEST5633823192.168.2.2380.149.81.191
          Aug 5, 2022 21:59:27.747862101 CEST5633823192.168.2.23246.173.169.254
          Aug 5, 2022 21:59:27.747868061 CEST5633823192.168.2.23130.204.157.39
          Aug 5, 2022 21:59:27.747899055 CEST5633823192.168.2.23190.195.249.68
          Aug 5, 2022 21:59:27.747905016 CEST5633823192.168.2.23213.236.72.245
          Aug 5, 2022 21:59:27.747992992 CEST5633823192.168.2.23204.233.118.138
          Aug 5, 2022 21:59:27.748017073 CEST5633823192.168.2.2380.65.137.39
          Aug 5, 2022 21:59:27.748025894 CEST5633823192.168.2.2392.44.167.219
          Aug 5, 2022 21:59:27.748044014 CEST5633823192.168.2.2357.217.33.64
          Aug 5, 2022 21:59:27.748055935 CEST5633823192.168.2.23182.105.94.154
          Aug 5, 2022 21:59:27.748061895 CEST5633823192.168.2.235.44.7.185
          Aug 5, 2022 21:59:27.748115063 CEST5633823192.168.2.23119.244.49.234
          Aug 5, 2022 21:59:27.748131037 CEST5633823192.168.2.23179.244.229.1
          Aug 5, 2022 21:59:27.748142958 CEST5633823192.168.2.23173.186.225.71
          Aug 5, 2022 21:59:27.748152018 CEST5633823192.168.2.2339.67.106.113
          Aug 5, 2022 21:59:27.748168945 CEST5633823192.168.2.23212.62.233.135
          Aug 5, 2022 21:59:27.748235941 CEST5633823192.168.2.23243.175.32.92
          Aug 5, 2022 21:59:27.748271942 CEST5633823192.168.2.234.184.16.160
          Aug 5, 2022 21:59:27.748281956 CEST5633823192.168.2.2393.120.68.226
          Aug 5, 2022 21:59:27.748291016 CEST5633823192.168.2.23120.93.222.3
          Aug 5, 2022 21:59:27.748298883 CEST5633823192.168.2.2324.143.151.136
          Aug 5, 2022 21:59:27.748306990 CEST5633823192.168.2.2347.31.211.92
          Aug 5, 2022 21:59:27.748311996 CEST5633823192.168.2.23171.201.64.211
          Aug 5, 2022 21:59:27.748362064 CEST5633823192.168.2.23222.100.218.22
          Aug 5, 2022 21:59:27.748363018 CEST5633823192.168.2.2317.230.119.245
          Aug 5, 2022 21:59:27.748382092 CEST5633823192.168.2.23167.216.231.176
          Aug 5, 2022 21:59:27.748384953 CEST5633823192.168.2.23101.58.237.46
          Aug 5, 2022 21:59:27.748397112 CEST5633823192.168.2.23111.202.237.32
          Aug 5, 2022 21:59:27.748400927 CEST5633823192.168.2.2362.217.236.3
          Aug 5, 2022 21:59:27.748411894 CEST5633823192.168.2.23223.114.20.235
          Aug 5, 2022 21:59:27.748425961 CEST5633823192.168.2.2368.61.196.101
          Aug 5, 2022 21:59:27.748434067 CEST5633823192.168.2.23243.14.57.171
          Aug 5, 2022 21:59:27.748483896 CEST5633823192.168.2.23113.177.96.195
          Aug 5, 2022 21:59:27.748493910 CEST5633823192.168.2.2362.56.54.206
          Aug 5, 2022 21:59:27.748514891 CEST5633823192.168.2.23185.72.72.163
          Aug 5, 2022 21:59:27.748521090 CEST5633823192.168.2.2340.26.233.34
          Aug 5, 2022 21:59:27.748524904 CEST5633823192.168.2.2385.96.48.149
          Aug 5, 2022 21:59:27.748554945 CEST5633823192.168.2.23178.147.100.32
          Aug 5, 2022 21:59:27.748594999 CEST5633823192.168.2.23183.60.226.92
          Aug 5, 2022 21:59:27.748619080 CEST5633823192.168.2.2319.73.144.109
          Aug 5, 2022 21:59:27.748639107 CEST5633823192.168.2.23169.16.51.38
          Aug 5, 2022 21:59:27.748647928 CEST5633823192.168.2.2318.41.50.12
          Aug 5, 2022 21:59:27.748655081 CEST5633823192.168.2.23243.43.141.110
          Aug 5, 2022 21:59:27.748666048 CEST5633823192.168.2.23160.105.106.26
          Aug 5, 2022 21:59:27.748692036 CEST5633823192.168.2.23109.37.60.227
          Aug 5, 2022 21:59:27.748708010 CEST5633823192.168.2.2398.70.226.64
          Aug 5, 2022 21:59:27.748717070 CEST5633823192.168.2.23184.110.95.215
          Aug 5, 2022 21:59:27.748720884 CEST5633823192.168.2.23250.253.117.236
          Aug 5, 2022 21:59:27.748728991 CEST5633823192.168.2.2324.126.221.127
          Aug 5, 2022 21:59:27.748764992 CEST5633823192.168.2.23250.100.192.43
          Aug 5, 2022 21:59:27.748778105 CEST5633823192.168.2.23211.238.179.243
          Aug 5, 2022 21:59:27.748792887 CEST5633823192.168.2.2336.24.149.143
          Aug 5, 2022 21:59:27.748811960 CEST5633823192.168.2.23100.159.164.147
          Aug 5, 2022 21:59:27.748832941 CEST5633823192.168.2.2320.12.4.193
          Aug 5, 2022 21:59:27.748862028 CEST5633823192.168.2.23175.88.90.62
          Aug 5, 2022 21:59:27.748862028 CEST5633823192.168.2.23139.152.34.189
          Aug 5, 2022 21:59:27.748903990 CEST5633823192.168.2.2323.243.161.5
          Aug 5, 2022 21:59:27.748912096 CEST5633823192.168.2.2360.109.46.95
          Aug 5, 2022 21:59:27.748914003 CEST5633823192.168.2.23167.2.179.46
          Aug 5, 2022 21:59:27.748914957 CEST5633823192.168.2.2347.36.47.143
          Aug 5, 2022 21:59:27.748918056 CEST5633823192.168.2.23121.97.214.191
          Aug 5, 2022 21:59:27.749012947 CEST5633823192.168.2.23200.91.81.139
          Aug 5, 2022 21:59:27.749018908 CEST5633823192.168.2.2339.17.142.249
          Aug 5, 2022 21:59:27.749032974 CEST5633823192.168.2.2379.237.117.203
          Aug 5, 2022 21:59:27.749063015 CEST5633823192.168.2.2387.220.112.76
          Aug 5, 2022 21:59:27.749083042 CEST5633823192.168.2.2387.82.36.193
          Aug 5, 2022 21:59:27.749105930 CEST5633823192.168.2.23200.90.86.151
          Aug 5, 2022 21:59:27.749146938 CEST5633823192.168.2.23211.169.115.42
          Aug 5, 2022 21:59:27.749165058 CEST5633823192.168.2.2344.146.133.202
          Aug 5, 2022 21:59:27.749166965 CEST5633823192.168.2.2336.216.196.17
          Aug 5, 2022 21:59:27.749197960 CEST5633823192.168.2.23209.190.203.195
          Aug 5, 2022 21:59:27.749207973 CEST5633823192.168.2.23185.53.188.36
          Aug 5, 2022 21:59:27.749221087 CEST5633823192.168.2.23196.225.52.132
          Aug 5, 2022 21:59:27.749239922 CEST5633823192.168.2.23109.119.208.249
          Aug 5, 2022 21:59:27.749250889 CEST5633823192.168.2.23180.109.220.145
          Aug 5, 2022 21:59:27.749264002 CEST5633823192.168.2.2376.35.171.135
          Aug 5, 2022 21:59:27.749269962 CEST5633823192.168.2.2357.20.58.80
          Aug 5, 2022 21:59:27.749270916 CEST5633823192.168.2.2341.190.196.221
          Aug 5, 2022 21:59:27.749303102 CEST5633823192.168.2.2372.139.156.69
          Aug 5, 2022 21:59:27.749308109 CEST5633823192.168.2.23147.9.48.228
          Aug 5, 2022 21:59:27.749309063 CEST5633823192.168.2.2385.183.122.44
          Aug 5, 2022 21:59:27.749363899 CEST5633823192.168.2.23105.29.200.114
          Aug 5, 2022 21:59:27.749368906 CEST5633823192.168.2.23120.77.33.69
          Aug 5, 2022 21:59:27.749372005 CEST5633823192.168.2.2367.39.96.220
          Aug 5, 2022 21:59:27.749378920 CEST5633823192.168.2.23200.241.14.167
          Aug 5, 2022 21:59:27.749381065 CEST5633823192.168.2.2357.170.146.127
          Aug 5, 2022 21:59:27.749387026 CEST5633823192.168.2.23190.19.101.198
          Aug 5, 2022 21:59:27.749396086 CEST5633823192.168.2.23166.33.95.65
          Aug 5, 2022 21:59:27.749470949 CEST5633823192.168.2.23250.17.150.230
          Aug 5, 2022 21:59:27.749511957 CEST5633823192.168.2.2358.192.171.184
          Aug 5, 2022 21:59:27.749520063 CEST5633823192.168.2.2390.18.23.233
          Aug 5, 2022 21:59:27.749537945 CEST5633823192.168.2.23212.95.10.3
          Aug 5, 2022 21:59:27.749550104 CEST5633823192.168.2.23114.46.19.43
          Aug 5, 2022 21:59:27.749594927 CEST5633823192.168.2.2313.250.232.168
          Aug 5, 2022 21:59:27.749603987 CEST5633823192.168.2.23179.40.137.91
          Aug 5, 2022 21:59:27.749614954 CEST5633823192.168.2.2396.59.245.34

          System Behavior

          General

          Start time:21:59:22
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:/tmp/VBeQtQfmgh
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:27
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:27
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:27
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:27
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:37
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:37
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

          General

          Start time:21:59:37
          Start date:05/08/2022
          Path:/tmp/VBeQtQfmgh
          Arguments:n/a
          File size:4956856 bytes
          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1