Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
yB9hLLnhbx.elf

Overview

General Information

Sample Name:yB9hLLnhbx.elf
Analysis ID:756320
MD5:f91d9aa9e9d29ae67a5d1d504050c519
SHA1:aad17596d13e5d9439141165e968f9001af29407
SHA256:b49d71d61bc5f0871a7fa5f4cb6816d9a58633440428a3ddec13346fd4386185
Tags:32elfgafgytmips
Infos:

Detection

Mirai
Score:80
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Contains symbols with names commonly found in malware
Opens /proc/net/* files useful for finding connected devices and routers
Yara signature match
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:756320
Start date and time:2022-11-30 01:18:06 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 34s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:yB9hLLnhbx.elf
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal80.spre.troj.linELF@0/1@0/0
Command:/tmp/yB9hLLnhbx.elf
PID:6229
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate alot
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
yB9hLLnhbx.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    yB9hLLnhbx.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19c98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19cac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19cc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19cd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19ce8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19cfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x19d10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    SourceRuleDescriptionAuthorStrings
    6231.1.00007fbb84400000.00007fbb8441e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6231.1.00007fbb84400000.00007fbb8441e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19ce8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19d10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      6232.1.00007fbb84400000.00007fbb8441e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6232.1.00007fbb84400000.00007fbb8441e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19ce8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19d10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        6229.1.00007fbb84400000.00007fbb8441e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          Click to see the 4 entries
          No Snort rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: yB9hLLnhbx.elfAvira: detected
          Source: yB9hLLnhbx.elfReversingLabs: Detection: 61%
          Source: yB9hLLnhbx.elfVirustotal: Detection: 63%Perma Link

          Spreading

          barindex
          Source: /tmp/yB9hLLnhbx.elf (PID: 6229)Opens: /proc/net/route
          Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
          Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
          Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
          Source: global trafficTCP traffic: 192.168.2.23:38500 -> 47.87.197.232:576
          Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232
          Source: unknownTCP traffic detected without corresponding DNS query: 47.87.197.232

          System Summary

          barindex
          Source: yB9hLLnhbx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: 6231.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: 6232.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: 6229.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: Process Memory Space: yB9hLLnhbx.elf PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: Process Memory Space: yB9hLLnhbx.elf PID: 6231, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: Process Memory Space: yB9hLLnhbx.elf PID: 6232, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: ELF static info symbol of initial sampleName: vseattack
          Source: yB9hLLnhbx.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: 6231.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: 6232.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: 6229.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: Process Memory Space: yB9hLLnhbx.elf PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: Process Memory Space: yB9hLLnhbx.elf PID: 6231, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: Process Memory Space: yB9hLLnhbx.elf PID: 6232, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: classification engineClassification label: mal80.spre.troj.linELF@0/1@0/0
          Source: yB9hLLnhbx.elfELF static info symbol of initial sample: libc/string/mips/memcpy.S
          Source: yB9hLLnhbx.elfELF static info symbol of initial sample: libc/string/mips/memset.S
          Source: yB9hLLnhbx.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
          Source: yB9hLLnhbx.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
          Source: yB9hLLnhbx.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
          Source: yB9hLLnhbx.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S
          Source: /tmp/yB9hLLnhbx.elf (PID: 6229)Queries kernel information via 'uname':
          Source: yB9hLLnhbx.elf, 6229.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.LkIBrb\
          Source: yB9hLLnhbx.elf, 6229.1.000055a0aa12d000.000055a0aa1b4000.rw-.sdmp, yB9hLLnhbx.elf, 6231.1.000055a0aa12d000.000055a0aa1b4000.rw-.sdmp, yB9hLLnhbx.elf, 6232.1.000055a0aa12d000.000055a0aa1b4000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips
          Source: yB9hLLnhbx.elf, 6229.1.000055a0aa12d000.000055a0aa1b4000.rw-.sdmp, yB9hLLnhbx.elf, 6231.1.000055a0aa12d000.000055a0aa1b4000.rw-.sdmp, yB9hLLnhbx.elf, 6232.1.000055a0aa12d000.000055a0aa1b4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
          Source: yB9hLLnhbx.elf, 6229.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmp, yB9hLLnhbx.elf, 6231.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmp, yB9hLLnhbx.elf, 6232.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
          Source: yB9hLLnhbx.elf, 6229.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmp, yB9hLLnhbx.elf, 6231.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmp, yB9hLLnhbx.elf, 6232.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmpBinary or memory string: Jx86_64/usr/bin/qemu-mips/tmp/yB9hLLnhbx.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yB9hLLnhbx.elf
          Source: yB9hLLnhbx.elf, 6229.1.00007ffcdd214000.00007ffcdd235000.rw-.sdmpBinary or memory string: /tmp/qemu-open.LkIBrb

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: yB9hLLnhbx.elf, type: SAMPLE
          Source: Yara matchFile source: 6231.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6232.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6229.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORY
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
          Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: yB9hLLnhbx.elf, type: SAMPLE
          Source: Yara matchFile source: 6231.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6232.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6229.1.00007fbb84400000.00007fbb8441e000.r-x.sdmp, type: MEMORY
          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
          Security Software Discovery
          Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
          Data Obfuscation
          Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
          Remote System Discovery
          Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
          Encrypted Channel
          Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
          Non-Standard Port
          Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
          Application Layer Protocol
          SIM Card SwapCarrier Billing Fraud
          No configs have been found
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          SourceDetectionScannerLabelLink
          yB9hLLnhbx.elf62%ReversingLabsLinux.Trojan.LnxGafgyt
          yB9hLLnhbx.elf63%VirustotalBrowse
          yB9hLLnhbx.elf100%AviraLINUX/Mirai.Gafgyt.
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No contacted domains info
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          47.87.197.232
          unknownUnited States
          3209VODANETInternationalIP-BackboneofVodafoneDEfalse
          109.202.202.202
          unknownSwitzerland
          13030INIT7CHfalse
          91.189.91.43
          unknownUnited Kingdom
          41231CANONICAL-ASGBfalse
          91.189.91.42
          unknownUnited Kingdom
          41231CANONICAL-ASGBfalse
          No context
          No context
          No context
          No context
          No context
          Process:/tmp/yB9hLLnhbx.elf
          File Type:ASCII text
          Category:dropped
          Size (bytes):230
          Entropy (8bit):3.709552666863289
          Encrypted:false
          SSDEEP:6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
          MD5:2E667F43AE18CD1FE3C108641708A82C
          SHA1:12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
          SHA-256:6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
          SHA-512:D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
          Malicious:false
          Reputation:high, very likely benign file
          Preview:Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.
          File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
          Entropy (8bit):5.320838724230978
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:yB9hLLnhbx.elf
          File size:155428
          MD5:f91d9aa9e9d29ae67a5d1d504050c519
          SHA1:aad17596d13e5d9439141165e968f9001af29407
          SHA256:b49d71d61bc5f0871a7fa5f4cb6816d9a58633440428a3ddec13346fd4386185
          SHA512:3293e2e6546b811a160a0cf204d955623f4c2e0ac7893ffafb6e114aca53b41a334875715ab12dac5512d98b298632e15e946fa890a453a3cb566b5420cd5c05
          SSDEEP:3072:JW6dK9tS1aRGQdK76t/zLEI5mrThPaLEnvPrNb:c6UG+LL5mrThPaLEnvPrNb
          TLSH:33E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54
          File Content Preview:.ELF.....................@.....4.........4. ...(....p........@...@...........................@...@...........................E...E.....P..o.........dt.Q.................................................FUP<...'.T....!'.......................<...'.T`...!...

          ELF header

          Class:
          Data:
          Version:
          Machine:
          Version Number:
          Type:
          OS/ABI:
          ABI Version:
          Entry Point Address:
          Flags:
          ELF Header Size:
          Program Header Offset:
          Program Header Size:
          Number of Program Headers:
          Section Header Offset:
          Section Header Size:
          Number of Section Headers:
          Header String Table Index:
          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .reginfoMIPS_REGINFO0x4000b40xb40x180x180x2A004
          .initPROGBITS0x4000cc0xcc0x8c0x00x6AX004
          .textPROGBITS0x4001600x1600x188b00x00x6AX0016
          .finiPROGBITS0x418a100x18a100x5c0x00x6AX004
          .rodataPROGBITS0x418a700x18a700x45a00x00x2A0016
          .eh_framePROGBITS0x41d0100x1d0100x40x00x2A004
          .ctorsPROGBITS0x45d0140x1d0140x80x00x3WA004
          .dtorsPROGBITS0x45d01c0x1d01c0x80x00x3WA004
          .jcrPROGBITS0x45d0240x1d0240x40x00x3WA004
          .data.rel.roPROGBITS0x45d0280x1d0280x4c0x00x3WA004
          .dataPROGBITS0x45d0800x1d0800x4e00x00x3WA0016
          .gotPROGBITS0x45d5600x1d5600x5040x40x10000003WAp0016
          .sbssNOBITS0x45da640x1da640x240x00x10000003WAp004
          .bssNOBITS0x45da900x1da640x648c0x00x3WA0016
          .commentPROGBITS0x00x1da640xbe20x00x0001
          .mdebug.abi32PROGBITS0xbe20x1e6460x00x00x0001
          .pdrPROGBITS0x00x1e6480x21200x00x0004
          .shstrtabSTRTAB0x00x207680x9a0x00x0001
          .symtabSYMTAB0x00x20b4c0x30300x100x0203214
          .strtabSTRTAB0x00x23b7c0x23a80x00x0001
          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          <unknown>0xb40x4000b40x4000b40x180x180.98340x4R 0x4.reginfo
          LOAD0x00x4000000x4000000x1d0140x1d0145.31310x5R E0x10000.reginfo .init .text .fini .rodata .eh_frame
          LOAD0x1d0140x45d0140x45d0140xa500x6f084.14010x6RW 0x10000.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
          NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
          .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          .symtab0x4000b40SECTION<unknown>DEFAULT1
          .symtab0x4000cc0SECTION<unknown>DEFAULT2
          .symtab0x4001600SECTION<unknown>DEFAULT3
          .symtab0x418a100SECTION<unknown>DEFAULT4
          .symtab0x418a700SECTION<unknown>DEFAULT5
          .symtab0x41d0100SECTION<unknown>DEFAULT6
          .symtab0x45d0140SECTION<unknown>DEFAULT7
          .symtab0x45d01c0SECTION<unknown>DEFAULT8
          .symtab0x45d0240SECTION<unknown>DEFAULT9
          .symtab0x45d0280SECTION<unknown>DEFAULT10
          .symtab0x45d0800SECTION<unknown>DEFAULT11
          .symtab0x45d5600SECTION<unknown>DEFAULT12
          .symtab0x45da640SECTION<unknown>DEFAULT13
          .symtab0x45da900SECTION<unknown>DEFAULT14
          .symtab0x00SECTION<unknown>DEFAULT15
          .symtab0xbe20SECTION<unknown>DEFAULT16
          .symtab0x00SECTION<unknown>DEFAULT17
          .symtab0x00SECTION<unknown>DEFAULT18
          .symtab0x00SECTION<unknown>DEFAULT19
          .symtab0x00SECTION<unknown>DEFAULT20
          C.151.5648.symtab0x45d02840OBJECT<unknown>DEFAULT10
          C.182.5940.symtab0x45d06416OBJECT<unknown>DEFAULT10
          C.183.5941.symtab0x45d05020OBJECT<unknown>DEFAULT10
          KHcommSOCK.symtab0x45dab04OBJECT<unknown>DEFAULT14
          KHserverHACKER.symtab0x45d0c44OBJECT<unknown>DEFAULT11
          LOCAL_ADDR.symtab0x45da644OBJECT<unknown>DEFAULT13
          Q.symtab0x45dacc16384OBJECT<unknown>DEFAULT14
          UserAgents.symtab0x45d0e0144OBJECT<unknown>DEFAULT11
          _GLOBAL_OFFSET_TABLE_.symtab0x45d5600OBJECT<unknown>DEFAULT12
          _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
          _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __CTOR_END__.symtab0x45d0180OBJECT<unknown>DEFAULT7
          __CTOR_LIST__.symtab0x45d0140OBJECT<unknown>DEFAULT7
          __C_ctype_b.symtab0x45d1804OBJECT<unknown>DEFAULT11
          __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_b_data.symtab0x41b870768OBJECT<unknown>DEFAULT5
          __C_ctype_tolower.symtab0x45d5504OBJECT<unknown>DEFAULT11
          __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_tolower_data.symtab0x41cd10768OBJECT<unknown>DEFAULT5
          __C_ctype_toupper.symtab0x45d1904OBJECT<unknown>DEFAULT11
          __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __C_ctype_toupper_data.symtab0x41bb70768OBJECT<unknown>DEFAULT5
          __DTOR_END__.symtab0x45d0200OBJECT<unknown>DEFAULT8
          __DTOR_LIST__.symtab0x45d01c0OBJECT<unknown>DEFAULT8
          __EH_FRAME_BEGIN__.symtab0x41d0100OBJECT<unknown>DEFAULT6
          __FRAME_END__.symtab0x41d0100OBJECT<unknown>DEFAULT6
          __GI___C_ctype_b.symtab0x45d1804OBJECT<unknown>HIDDEN11
          __GI___C_ctype_b_data.symtab0x41b870768OBJECT<unknown>HIDDEN5
          __GI___C_ctype_tolower.symtab0x45d5504OBJECT<unknown>HIDDEN11
          __GI___C_ctype_tolower_data.symtab0x41cd10768OBJECT<unknown>HIDDEN5
          __GI___C_ctype_toupper.symtab0x45d1904OBJECT<unknown>HIDDEN11
          __GI___C_ctype_toupper_data.symtab0x41bb70768OBJECT<unknown>HIDDEN5
          __GI___ctype_b.symtab0x45d1844OBJECT<unknown>HIDDEN11
          __GI___ctype_tolower.symtab0x45d5544OBJECT<unknown>HIDDEN11
          __GI___ctype_toupper.symtab0x45d1944OBJECT<unknown>HIDDEN11
          __GI___errno_location.symtab0x40e45024FUNC<unknown>HIDDEN3
          __GI___fgetc_unlocked.symtab0x4182f0388FUNC<unknown>HIDDEN3
          __GI___glibc_strerror_r.symtab0x4103e068FUNC<unknown>HIDDEN3
          __GI___h_errno_location.symtab0x4134c024FUNC<unknown>HIDDEN3
          __GI___libc_fcntl.symtab0x40db00136FUNC<unknown>HIDDEN3
          __GI___libc_fcntl64.symtab0x40db90104FUNC<unknown>HIDDEN3
          __GI___libc_open.symtab0x40e070124FUNC<unknown>HIDDEN3
          __GI___uClibc_fini.symtab0x412aa0196FUNC<unknown>HIDDEN3
          __GI___uClibc_init.symtab0x412bfc140FUNC<unknown>HIDDEN3
          __GI___xpg_strerror_r.symtab0x410430392FUNC<unknown>HIDDEN3
          __GI__exit.symtab0x40dc0080FUNC<unknown>HIDDEN3
          __GI_abort.symtab0x415b60428FUNC<unknown>HIDDEN3
          __GI_atoi.symtab0x41238028FUNC<unknown>HIDDEN3
          __GI_atol.symtab0x41238028FUNC<unknown>HIDDEN3
          __GI_brk.symtab0x415d40112FUNC<unknown>HIDDEN3
          __GI_close.symtab0x40dcb084FUNC<unknown>HIDDEN3
          __GI_connect.symtab0x410c6084FUNC<unknown>HIDDEN3
          __GI_dup2.symtab0x40dd1084FUNC<unknown>HIDDEN3
          __GI_errno.symtab0x463d304OBJECT<unknown>HIDDEN14
          __GI_execl.symtab0x412700204FUNC<unknown>HIDDEN3
          __GI_execve.symtab0x41319084FUNC<unknown>HIDDEN3
          __GI_exit.symtab0x412610236FUNC<unknown>HIDDEN3
          __GI_fclose.symtab0x415e10512FUNC<unknown>HIDDEN3
          __GI_fcntl.symtab0x40db00136FUNC<unknown>HIDDEN3
          __GI_fcntl64.symtab0x40db90104FUNC<unknown>HIDDEN3
          __GI_fflush_unlocked.symtab0x4169b0628FUNC<unknown>HIDDEN3
          __GI_fgetc_unlocked.symtab0x4182f0388FUNC<unknown>HIDDEN3
          __GI_fgets.symtab0x416740216FUNC<unknown>HIDDEN3
          __GI_fgets_unlocked.symtab0x416c30268FUNC<unknown>HIDDEN3
          __GI_fopen.symtab0x41601028FUNC<unknown>HIDDEN3
          __GI_fork.symtab0x40dd7084FUNC<unknown>HIDDEN3
          __GI_fputs_unlocked.symtab0x40fb90128FUNC<unknown>HIDDEN3
          __GI_fseek.symtab0x41603068FUNC<unknown>HIDDEN3
          __GI_fseeko64.symtab0x416080388FUNC<unknown>HIDDEN3
          __GI_fwrite_unlocked.symtab0x40fc10280FUNC<unknown>HIDDEN3
          __GI_getc_unlocked.symtab0x4182f0388FUNC<unknown>HIDDEN3
          __GI_getdtablesize.symtab0x40ddd072FUNC<unknown>HIDDEN3
          __GI_getegid.symtab0x4131f088FUNC<unknown>HIDDEN3
          __GI_geteuid.symtab0x40de2088FUNC<unknown>HIDDEN3
          __GI_getgid.symtab0x41325084FUNC<unknown>HIDDEN3
          __GI_gethostbyname.symtab0x410780116FUNC<unknown>HIDDEN3
          __GI_gethostbyname_r.symtab0x4108001108FUNC<unknown>HIDDEN3
          __GI_getpid.symtab0x40de8084FUNC<unknown>HIDDEN3
          __GI_getrlimit.symtab0x40df4084FUNC<unknown>HIDDEN3
          __GI_getsockname.symtab0x410cc084FUNC<unknown>HIDDEN3
          __GI_getuid.symtab0x4132b084FUNC<unknown>HIDDEN3
          __GI_h_errno.symtab0x463d344OBJECT<unknown>HIDDEN14
          __GI_inet_addr.symtab0x41073072FUNC<unknown>HIDDEN3
          __GI_inet_aton.symtab0x414c00244FUNC<unknown>HIDDEN3
          __GI_inet_ntop.symtab0x417550852FUNC<unknown>HIDDEN3
          __GI_inet_pton.symtab0x4170a0700FUNC<unknown>HIDDEN3
          __GI_initstate_r.symtab0x412230328FUNC<unknown>HIDDEN3
          __GI_ioctl.symtab0x40dfa0104FUNC<unknown>HIDDEN3
          __GI_isatty.symtab0x41062060FUNC<unknown>HIDDEN3
          __GI_kill.symtab0x40e01088FUNC<unknown>HIDDEN3
          __GI_lseek64.symtab0x418200168FUNC<unknown>HIDDEN3
          __GI_memchr.symtab0x414550264FUNC<unknown>HIDDEN3
          __GI_memcpy.symtab0x40fd30308FUNC<unknown>HIDDEN3
          __GI_memmove.symtab0x414660816FUNC<unknown>HIDDEN3
          __GI_mempcpy.symtab0x41499076FUNC<unknown>HIDDEN3
          __GI_memrchr.symtab0x4149e0272FUNC<unknown>HIDDEN3
          __GI_memset.symtab0x40fe70144FUNC<unknown>HIDDEN3
          __GI_nanosleep.symtab0x41331084FUNC<unknown>HIDDEN3
          __GI_open.symtab0x40e070124FUNC<unknown>HIDDEN3
          __GI_pipe.symtab0x40dac064FUNC<unknown>HIDDEN3
          __GI_poll.symtab0x415db084FUNC<unknown>HIDDEN3
          __GI_raise.symtab0x4181b076FUNC<unknown>HIDDEN3
          __GI_random.symtab0x411c00164FUNC<unknown>HIDDEN3
          __GI_random_r.symtab0x41200c176FUNC<unknown>HIDDEN3
          __GI_rawmemchr.symtab0x416d40200FUNC<unknown>HIDDEN3
          __GI_read.symtab0x40e19084FUNC<unknown>HIDDEN3
          __GI_recv.symtab0x410da084FUNC<unknown>HIDDEN3
          __GI_recvfrom.symtab0x410e00128FUNC<unknown>HIDDEN3
          __GI_sbrk.symtab0x413370144FUNC<unknown>HIDDEN3
          __GI_select.symtab0x40e1f0120FUNC<unknown>HIDDEN3
          __GI_send.symtab0x410e8084FUNC<unknown>HIDDEN3
          __GI_sendto.symtab0x410ee0128FUNC<unknown>HIDDEN3
          __GI_setsockopt.symtab0x410f60120FUNC<unknown>HIDDEN3
          __GI_setstate_r.symtab0x411ed0316FUNC<unknown>HIDDEN3
          __GI_sigaction.symtab0x413040232FUNC<unknown>HIDDEN3
          __GI_sigaddset.symtab0x411040104FUNC<unknown>HIDDEN3
          __GI_sigemptyset.symtab0x4110b060FUNC<unknown>HIDDEN3
          __GI_signal.symtab0x4110f0252FUNC<unknown>HIDDEN3
          __GI_sigprocmask.symtab0x40e270148FUNC<unknown>HIDDEN3
          __GI_sleep.symtab0x4127d0564FUNC<unknown>HIDDEN3
          __GI_socket.symtab0x410fe084FUNC<unknown>HIDDEN3
          __GI_sprintf.symtab0x40e4e080FUNC<unknown>HIDDEN3
          __GI_srandom_r.symtab0x4120bc372FUNC<unknown>HIDDEN3
          __GI_strcasecmp.symtab0x418480108FUNC<unknown>HIDDEN3
          __GI_strchr.symtab0x40ff00256FUNC<unknown>HIDDEN3
          __GI_strcmp.symtab0x41000044FUNC<unknown>HIDDEN3
          __GI_strcoll.symtab0x41000044FUNC<unknown>HIDDEN3
          __GI_strcpy.symtab0x41003036FUNC<unknown>HIDDEN3
          __GI_strdup.symtab0x416f20144FUNC<unknown>HIDDEN3
          __GI_strlen.symtab0x410060184FUNC<unknown>HIDDEN3
          __GI_strncat.symtab0x416e10180FUNC<unknown>HIDDEN3
          __GI_strncpy.symtab0x410120188FUNC<unknown>HIDDEN3
          __GI_strnlen.symtab0x4101e0256FUNC<unknown>HIDDEN3
          __GI_strpbrk.symtab0x414bc064FUNC<unknown>HIDDEN3
          __GI_strspn.symtab0x416ed076FUNC<unknown>HIDDEN3
          __GI_strstr.symtab0x4102e0256FUNC<unknown>HIDDEN3
          __GI_strtok.symtab0x41060032FUNC<unknown>HIDDEN3
          __GI_strtok_r.symtab0x414af0204FUNC<unknown>HIDDEN3
          __GI_strtol.symtab0x4123a028FUNC<unknown>HIDDEN3
          __GI_tcgetattr.symtab0x410660176FUNC<unknown>HIDDEN3
          __GI_time.symtab0x40e31084FUNC<unknown>HIDDEN3
          __GI_times.symtab0x41340084FUNC<unknown>HIDDEN3
          __GI_tolower.symtab0x4182b060FUNC<unknown>HIDDEN3
          __GI_toupper.symtab0x40e41060FUNC<unknown>HIDDEN3
          __GI_vfork.symtab0x40e37028FUNC<unknown>HIDDEN3
          __GI_vsnprintf.symtab0x40e530260FUNC<unknown>HIDDEN3
          __GI_wait4.symtab0x41346088FUNC<unknown>HIDDEN3
          __GI_waitpid.symtab0x40e39028FUNC<unknown>HIDDEN3
          __GI_wcrtomb.symtab0x4134e0112FUNC<unknown>HIDDEN3
          __GI_wcsnrtombs.symtab0x413590228FUNC<unknown>HIDDEN3
          __GI_wcsrtombs.symtab0x41355064FUNC<unknown>HIDDEN3
          __GI_write.symtab0x40e3b084FUNC<unknown>HIDDEN3
          __JCR_END__.symtab0x45d0240OBJECT<unknown>DEFAULT9
          __JCR_LIST__.symtab0x45d0240OBJECT<unknown>DEFAULT9
          __app_fini.symtab0x463d1c4OBJECT<unknown>HIDDEN14
          __atexit_lock.symtab0x45d4d024OBJECT<unknown>DEFAULT11
          __bsd_signal.symtab0x4110f0252FUNC<unknown>HIDDEN3
          __bss_start.symtab0x45da640NOTYPE<unknown>DEFAULTSHN_ABS
          __check_one_fd.symtab0x412b74136FUNC<unknown>DEFAULT3
          __ctype_b.symtab0x45d1844OBJECT<unknown>DEFAULT11
          __ctype_tolower.symtab0x45d5544OBJECT<unknown>DEFAULT11
          __ctype_toupper.symtab0x45d1944OBJECT<unknown>DEFAULT11
          __curbrk.symtab0x463d704OBJECT<unknown>HIDDEN14
          __data_start.symtab0x45d0a00OBJECT<unknown>DEFAULT11
          __decode_answer.symtab0x417bb0340FUNC<unknown>HIDDEN3
          __decode_dotted.symtab0x418610340FUNC<unknown>HIDDEN3
          __decode_header.symtab0x4179c0228FUNC<unknown>HIDDEN3
          __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
          __dns_lookup.symtab0x414d002568FUNC<unknown>HIDDEN3
          __do_global_ctors_aux.symtab0x4189a00FUNC<unknown>DEFAULT3
          __do_global_dtors_aux.symtab0x4001600FUNC<unknown>DEFAULT3
          __dso_handle.symtab0x45d0800OBJECT<unknown>HIDDEN11
          __encode_dotted.symtab0x4184f0280FUNC<unknown>HIDDEN3
          __encode_header.symtab0x4178b0272FUNC<unknown>HIDDEN3
          __encode_question.symtab0x417ab0172FUNC<unknown>HIDDEN3
          __environ.symtab0x463d144OBJECT<unknown>DEFAULT14
          __errno_location.symtab0x40e45024FUNC<unknown>DEFAULT3
          __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __exit_cleanup.symtab0x463d004OBJECT<unknown>HIDDEN14
          __fgetc_unlocked.symtab0x4182f0388FUNC<unknown>DEFAULT3
          __fini_array_end.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
          __fini_array_start.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
          __get_hosts_byname_r.symtab0x415af0104FUNC<unknown>HIDDEN3
          __glibc_strerror_r.symtab0x4103e068FUNC<unknown>DEFAULT3
          __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __h_errno_location.symtab0x4134c024FUNC<unknown>DEFAULT3
          __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __heap_alloc.symtab0x4118a0188FUNC<unknown>DEFAULT3
          __heap_alloc_at.symtab0x411960184FUNC<unknown>DEFAULT3
          __heap_free.symtab0x411a68364FUNC<unknown>DEFAULT3
          __heap_link_free_area.symtab0x411a2044FUNC<unknown>DEFAULT3
          __heap_link_free_area_after.symtab0x411a4c28FUNC<unknown>DEFAULT3
          __init_array_end.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
          __init_array_start.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
          __length_dotted.symtab0x41877072FUNC<unknown>HIDDEN3
          __length_question.symtab0x417b6072FUNC<unknown>HIDDEN3
          __libc_close.symtab0x40dcb084FUNC<unknown>DEFAULT3
          __libc_connect.symtab0x410c6084FUNC<unknown>DEFAULT3
          __libc_creat.symtab0x40e0ec28FUNC<unknown>DEFAULT3
          __libc_fcntl.symtab0x40db00136FUNC<unknown>DEFAULT3
          __libc_fcntl64.symtab0x40db90104FUNC<unknown>DEFAULT3
          __libc_fork.symtab0x40dd7084FUNC<unknown>DEFAULT3
          __libc_getpid.symtab0x40de8084FUNC<unknown>DEFAULT3
          __libc_lseek64.symtab0x418200168FUNC<unknown>DEFAULT3
          __libc_nanosleep.symtab0x41331084FUNC<unknown>DEFAULT3
          __libc_open.symtab0x40e070124FUNC<unknown>DEFAULT3
          __libc_poll.symtab0x415db084FUNC<unknown>DEFAULT3
          __libc_read.symtab0x40e19084FUNC<unknown>DEFAULT3
          __libc_recv.symtab0x410da084FUNC<unknown>DEFAULT3
          __libc_recvfrom.symtab0x410e00128FUNC<unknown>DEFAULT3
          __libc_select.symtab0x40e1f0120FUNC<unknown>DEFAULT3
          __libc_send.symtab0x410e8084FUNC<unknown>DEFAULT3
          __libc_sendto.symtab0x410ee0128FUNC<unknown>DEFAULT3
          __libc_sigaction.symtab0x413040232FUNC<unknown>DEFAULT3
          __libc_stack_end.symtab0x463d104OBJECT<unknown>DEFAULT14
          __libc_waitpid.symtab0x40e39028FUNC<unknown>DEFAULT3
          __libc_write.symtab0x40e3b084FUNC<unknown>DEFAULT3
          __malloc_heap.symtab0x45d4004OBJECT<unknown>DEFAULT11
          __malloc_heap_lock.symtab0x463ce024OBJECT<unknown>DEFAULT14
          __malloc_sbrk_lock.symtab0x463ee824OBJECT<unknown>DEFAULT14
          __nameserver.symtab0x463f1012OBJECT<unknown>HIDDEN14
          __nameservers.symtab0x45da784OBJECT<unknown>HIDDEN13
          __open_etc_hosts.symtab0x417d10108FUNC<unknown>HIDDEN3
          __open_nameservers.symtab0x415710984FUNC<unknown>HIDDEN3
          __pagesize.symtab0x463d184OBJECT<unknown>DEFAULT14
          __preinit_array_end.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
          __preinit_array_start.symtab0x45d0140NOTYPE<unknown>HIDDENSHN_ABS
          __pthread_initialize_minimal.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
          __pthread_mutex_init.symtab0x412b648FUNC<unknown>DEFAULT3
          __pthread_mutex_lock.symtab0x412b648FUNC<unknown>DEFAULT3
          __pthread_mutex_trylock.symtab0x412b648FUNC<unknown>DEFAULT3
          __pthread_mutex_unlock.symtab0x412b648FUNC<unknown>DEFAULT3
          __pthread_return_0.symtab0x412b648FUNC<unknown>DEFAULT3
          __pthread_return_void.symtab0x412b6c8FUNC<unknown>DEFAULT3
          __raise.symtab0x4181b076FUNC<unknown>HIDDEN3
          __read_etc_hosts_r.symtab0x417d7c1076FUNC<unknown>HIDDEN3
          __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
          __resolv_lock.symtab0x45d51024OBJECT<unknown>DEFAULT11
          __rtld_fini.symtab0x463d204OBJECT<unknown>HIDDEN14
          __searchdomain.symtab0x463f0016OBJECT<unknown>HIDDEN14
          __searchdomains.symtab0x45da7c4OBJECT<unknown>HIDDEN13
          __sigaddset.symtab0x41121844FUNC<unknown>DEFAULT3
          __sigdelset.symtab0x41124448FUNC<unknown>DEFAULT3
          __sigismember.symtab0x4111f040FUNC<unknown>DEFAULT3
          __start.symtab0x4002a0100FUNC<unknown>DEFAULT3
          __stdin.symtab0x45d1ec4OBJECT<unknown>DEFAULT11
          __stdio_READ.symtab0x4187c0140FUNC<unknown>HIDDEN3
          __stdio_WRITE.symtab0x413680280FUNC<unknown>HIDDEN3
          __stdio_adjust_position.symtab0x416210324FUNC<unknown>HIDDEN3
          __stdio_fwrite.symtab0x4137a0472FUNC<unknown>HIDDEN3
          __stdio_init_mutex.symtab0x40e6f832FUNC<unknown>HIDDEN3
          __stdio_mutex_initializer.3833.symtab0x41be7024OBJECT<unknown>DEFAULT5
          __stdio_rfill.symtab0x41885088FUNC<unknown>HIDDEN3
          __stdio_seek.symtab0x4166d0112FUNC<unknown>HIDDEN3
          __stdio_trans2r_o.symtab0x4188b0228FUNC<unknown>HIDDEN3
          __stdio_trans2w_o.symtab0x413980308FUNC<unknown>HIDDEN3
          __stdio_wcommit.symtab0x40e840100FUNC<unknown>HIDDEN3
          __stdout.symtab0x45d1f04OBJECT<unknown>DEFAULT11
          __syscall_error.symtab0x412ff072FUNC<unknown>HIDDEN3
          __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __syscall_rt_sigaction.symtab0x41313084FUNC<unknown>HIDDEN3
          __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __uClibc_fini.symtab0x412aa0196FUNC<unknown>DEFAULT3
          __uClibc_init.symtab0x412bfc140FUNC<unknown>DEFAULT3
          __uClibc_main.symtab0x412c88864FUNC<unknown>DEFAULT3
          __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          __uclibc_progname.symtab0x45d4f04OBJECT<unknown>HIDDEN11
          __vfork.symtab0x40e37028FUNC<unknown>HIDDEN3
          __xpg_strerror_r.symtab0x410430392FUNC<unknown>DEFAULT3
          __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _charpad.symtab0x40e8b0128FUNC<unknown>DEFAULT3
          _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _dl_aux_init.symtab0x415d1044FUNC<unknown>DEFAULT3
          _dl_phdr.symtab0x45da804OBJECT<unknown>DEFAULT13
          _dl_phnum.symtab0x45da844OBJECT<unknown>DEFAULT13
          _edata.symtab0x45da640NOTYPE<unknown>DEFAULTSHN_ABS
          _end.symtab0x463f1c0NOTYPE<unknown>DEFAULTSHN_ABS
          _errno.symtab0x463d304OBJECT<unknown>DEFAULT14
          _exit.symtab0x40dc0080FUNC<unknown>DEFAULT3
          _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _fbss.symtab0x45da640NOTYPE<unknown>DEFAULTSHN_ABS
          _fdata.symtab0x45d0800NOTYPE<unknown>DEFAULT11
          _fini.symtab0x418a1028FUNC<unknown>DEFAULT4
          _fixed_buffers.symtab0x461ae88192OBJECT<unknown>DEFAULT14
          _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _fp_out_narrow.symtab0x40e930228FUNC<unknown>DEFAULT3
          _fpmaxtostr.symtab0x413d002120FUNC<unknown>HIDDEN3
          _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ftext.symtab0x4001600NOTYPE<unknown>DEFAULT3
          _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _gp.symtab0x4655500NOTYPE<unknown>DEFAULTSHN_ABS
          _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
          _h_errno.symtab0x463d344OBJECT<unknown>DEFAULT14
          _init.symtab0x4000cc28FUNC<unknown>DEFAULT2
          _load_inttype.symtab0x413ac0136FUNC<unknown>HIDDEN3
          _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_init.symtab0x40f1c0220FUNC<unknown>HIDDEN3
          _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_parsespec.symtab0x40f59c1512FUNC<unknown>HIDDEN3
          _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_prepargs.symtab0x40f2a0100FUNC<unknown>HIDDEN3
          _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _ppfs_setargs.symtab0x40f310540FUNC<unknown>HIDDEN3
          _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _promoted_size.symtab0x40f530108FUNC<unknown>DEFAULT3
          _pthread_cleanup_pop_restore.symtab0x412b6c8FUNC<unknown>DEFAULT3
          _pthread_cleanup_push_defer.symtab0x412b6c8FUNC<unknown>DEFAULT3
          _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _sigintr.symtab0x463e68128OBJECT<unknown>HIDDEN14
          _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _stdio_fopen.symtab0x416360880FUNC<unknown>HIDDEN3
          _stdio_init.symtab0x40e640184FUNC<unknown>HIDDEN3
          _stdio_openlist.symtab0x45d1f44OBJECT<unknown>DEFAULT11
          _stdio_openlist_add_lock.symtab0x45d1a024OBJECT<unknown>DEFAULT11
          _stdio_openlist_dec_use.symtab0x416820400FUNC<unknown>DEFAULT3
          _stdio_openlist_del_count.symtab0x461ae44OBJECT<unknown>DEFAULT14
          _stdio_openlist_del_lock.symtab0x45d1b824OBJECT<unknown>DEFAULT11
          _stdio_openlist_use_count.symtab0x461ae04OBJECT<unknown>DEFAULT14
          _stdio_streams.symtab0x45d1f8240OBJECT<unknown>DEFAULT11
          _stdio_term.symtab0x40e718284FUNC<unknown>HIDDEN3
          _stdio_user_locking.symtab0x45d1d04OBJECT<unknown>DEFAULT11
          _stdlib_strto_l.symtab0x4123c0592FUNC<unknown>HIDDEN3
          _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _store_inttype.symtab0x413b5068FUNC<unknown>HIDDEN3
          _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _string_syserrmsgs.symtab0x41bfe02934OBJECT<unknown>HIDDEN5
          _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _uintmaxtostr.symtab0x413ba0340FUNC<unknown>HIDDEN3
          _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _vfprintf_internal.symtab0x40ea141960FUNC<unknown>HIDDEN3
          _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          abort.symtab0x415b60428FUNC<unknown>DEFAULT3
          abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          access.symtab0x40dc5084FUNC<unknown>DEFAULT3
          access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          acnc.symtab0x40623c372FUNC<unknown>DEFAULT3
          add_entry.symtab0x40c4f4200FUNC<unknown>DEFAULT3
          atoi.symtab0x41238028FUNC<unknown>DEFAULT3
          atol.symtab0x41238028FUNC<unknown>DEFAULT3
          atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          axis_bp.symtab0x45d0c04OBJECT<unknown>DEFAULT11
          bcopy.symtab0x4105c032FUNC<unknown>DEFAULT3
          bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          been_there_done_that.symtab0x463d604OBJECT<unknown>DEFAULT14
          been_there_done_that.2792.symtab0x463d244OBJECT<unknown>DEFAULT14
          brk.symtab0x415d40112FUNC<unknown>DEFAULT3
          brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          bsd_signal.symtab0x4110f0252FUNC<unknown>DEFAULT3
          buf.4833.symtab0x463b00460OBJECT<unknown>DEFAULT14
          bzero.symtab0x4105e028FUNC<unknown>DEFAULT3
          bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          c.symtab0x45d0cc4OBJECT<unknown>DEFAULT11
          calloc.symtab0x411470180FUNC<unknown>DEFAULT3
          calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          checksum_generic.symtab0x400310268FUNC<unknown>DEFAULT3
          checksum_tcp_udp.symtab0x40041c572FUNC<unknown>DEFAULT3
          checksum_tcpudp.symtab0x400658572FUNC<unknown>DEFAULT3
          clock.symtab0x40e470108FUNC<unknown>DEFAULT3
          clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          close.symtab0x40dcb084FUNC<unknown>DEFAULT3
          close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          completed.2296.symtab0x45da901OBJECT<unknown>DEFAULT14
          connect.symtab0x410c6084FUNC<unknown>DEFAULT3
          connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          connectTimeout.symtab0x403024828FUNC<unknown>DEFAULT3
          creat.symtab0x40e0ec28FUNC<unknown>DEFAULT3
          crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          csum.symtab0x403688460FUNC<unknown>DEFAULT3
          data_start.symtab0x45d0a00OBJECT<unknown>DEFAULT11
          decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          dup2.symtab0x40dd1084FUNC<unknown>DEFAULT3
          dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          environ.symtab0x463d144OBJECT<unknown>DEFAULT14
          errno.symtab0x463d304OBJECT<unknown>DEFAULT14
          errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          estridx.symtab0x41bf50126OBJECT<unknown>DEFAULT5
          execl.symtab0x412700204FUNC<unknown>DEFAULT3
          execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          execve.symtab0x41319084FUNC<unknown>DEFAULT3
          execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          exit.symtab0x412610236FUNC<unknown>DEFAULT3
          exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          exp10_table.symtab0x41cbf872OBJECT<unknown>DEFAULT5
          fclose.symtab0x415e10512FUNC<unknown>DEFAULT3
          fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fcntl.symtab0x40db00136FUNC<unknown>DEFAULT3
          fcntl64.symtab0x40db90104FUNC<unknown>DEFAULT3
          fdgets.symtab0x402604292FUNC<unknown>DEFAULT3
          fdopen_pids.symtab0x461acc4OBJECT<unknown>DEFAULT14
          fdpclose.symtab0x402388636FUNC<unknown>DEFAULT3
          fdpopen.symtab0x401f141140FUNC<unknown>DEFAULT3
          fflush_unlocked.symtab0x4169b0628FUNC<unknown>DEFAULT3
          fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgetc_unlocked.symtab0x4182f0388FUNC<unknown>DEFAULT3
          fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgets.symtab0x416740216FUNC<unknown>DEFAULT3
          fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fgets_unlocked.symtab0x416c30268FUNC<unknown>DEFAULT3
          fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          findRandIP.symtab0x4035dc172FUNC<unknown>DEFAULT3
          fmt.symtab0x41cbe020OBJECT<unknown>DEFAULT5
          fopen.symtab0x41601028FUNC<unknown>DEFAULT3
          fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fork.symtab0x40dd7084FUNC<unknown>DEFAULT3
          fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fputs_unlocked.symtab0x40fb90128FUNC<unknown>DEFAULT3
          fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          frame_dummy.symtab0x40021c0FUNC<unknown>DEFAULT3
          free.symtab0x411530396FUNC<unknown>DEFAULT3
          free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fseek.symtab0x41603068FUNC<unknown>DEFAULT3
          fseeko.symtab0x41603068FUNC<unknown>DEFAULT3
          fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fseeko64.symtab0x416080388FUNC<unknown>DEFAULT3
          fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          fwrite_unlocked.symtab0x40fc10280FUNC<unknown>DEFAULT3
          fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getBuild.symtab0x409f8432FUNC<unknown>DEFAULT3
          getHost.symtab0x402a68160FUNC<unknown>DEFAULT3
          getOurIP.symtab0x409c04896FUNC<unknown>DEFAULT3
          get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getc_unlocked.symtab0x4182f0388FUNC<unknown>DEFAULT3
          getdtablesize.symtab0x40ddd072FUNC<unknown>DEFAULT3
          getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getegid.symtab0x4131f088FUNC<unknown>DEFAULT3
          getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          geteuid.symtab0x40de2088FUNC<unknown>DEFAULT3
          geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getgid.symtab0x41325084FUNC<unknown>DEFAULT3
          getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostbyname.symtab0x410780116FUNC<unknown>DEFAULT3
          gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          gethostbyname_r.symtab0x4108001108FUNC<unknown>DEFAULT3
          gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getpid.symtab0x40de8084FUNC<unknown>DEFAULT3
          getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getppid.symtab0x40dee084FUNC<unknown>DEFAULT3
          getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getrlimit.symtab0x40df4084FUNC<unknown>DEFAULT3
          getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getsockname.symtab0x410cc084FUNC<unknown>DEFAULT3
          getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getsockopt.symtab0x410d20120FUNC<unknown>DEFAULT3
          getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          getuid.symtab0x4132b084FUNC<unknown>DEFAULT3
          getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          h.4832.symtab0x463ccc20OBJECT<unknown>DEFAULT14
          h_errno.symtab0x463d344OBJECT<unknown>DEFAULT14
          hacks.symtab0x45d0b04OBJECT<unknown>DEFAULT11
          hacks2.symtab0x45d0b44OBJECT<unknown>DEFAULT11
          hacks3.symtab0x45d0b84OBJECT<unknown>DEFAULT11
          hacks4.symtab0x45d0bc4OBJECT<unknown>DEFAULT11
          heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          heap_alloc_at.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          hextable.symtab0x4197641024OBJECT<unknown>DEFAULT5
          hlt.symtab0x4002fc0NOTYPE<unknown>DEFAULT3
          htonl.symtab0x4107208FUNC<unknown>DEFAULT3
          htons.symtab0x4107288FUNC<unknown>DEFAULT3
          httphex.symtab0x40656c1672FUNC<unknown>DEFAULT3
          i.4419.symtab0x45d0d04OBJECT<unknown>DEFAULT11
          index.symtab0x40ff00256FUNC<unknown>DEFAULT3
          inet_addr.symtab0x41073072FUNC<unknown>DEFAULT3
          inet_aton.symtab0x414c00244FUNC<unknown>DEFAULT3
          inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          inet_ntop.symtab0x417550852FUNC<unknown>DEFAULT3
          inet_ntop4.symtab0x41735c500FUNC<unknown>DEFAULT3
          inet_pton.symtab0x4170a0700FUNC<unknown>DEFAULT3
          inet_pton4.symtab0x416fb0240FUNC<unknown>DEFAULT3
          initConnection.symtab0x409940708FUNC<unknown>DEFAULT3
          init_rand.symtab0x400ad4300FUNC<unknown>DEFAULT3
          initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          initial_fa.symtab0x45d2f0264OBJECT<unknown>DEFAULT11
          initstate.symtab0x411d54208FUNC<unknown>DEFAULT3
          initstate_r.symtab0x412230328FUNC<unknown>DEFAULT3
          ioctl.symtab0x40dfa0104FUNC<unknown>DEFAULT3
          ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          isatty.symtab0x41062060FUNC<unknown>DEFAULT3
          isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          kill.symtab0x40e01088FUNC<unknown>DEFAULT3
          kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          killer_status.symtab0x45dac04OBJECT<unknown>DEFAULT14
          lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc/string/mips/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc/string/mips/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc/sysdeps/linux/mips/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc/sysdeps/linux/mips/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc/sysdeps/linux/mips/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          libc/sysdeps/linux/mips/pipe.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          listFork.symtab0x403360636FUNC<unknown>DEFAULT3
          llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          lseek64.symtab0x418200168FUNC<unknown>DEFAULT3
          macAddress.symtab0x45dac46OBJECT<unknown>DEFAULT14
          main.symtab0x409fa43464FUNC<unknown>DEFAULT3
          main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          makeIPPacket.symtab0x4039b8312FUNC<unknown>DEFAULT3
          makeRandomStr.symtab0x402bac268FUNC<unknown>DEFAULT3
          makevsepacket.symtab0x405714348FUNC<unknown>DEFAULT3
          malloc.symtab0x411280492FUNC<unknown>DEFAULT3
          malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memchr.symtab0x414550264FUNC<unknown>DEFAULT3
          memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memcpy.symtab0x40fd30308FUNC<unknown>DEFAULT3
          memmove.symtab0x414660816FUNC<unknown>DEFAULT3
          memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          mempcpy.symtab0x41499076FUNC<unknown>DEFAULT3
          mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memrchr.symtab0x4149e0272FUNC<unknown>DEFAULT3
          memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          memset.symtab0x40fe70144FUNC<unknown>DEFAULT3
          mylock.symtab0x45d41024OBJECT<unknown>DEFAULT11
          mylock.symtab0x463d4024OBJECT<unknown>DEFAULT14
          mylock.symtab0x45d53024OBJECT<unknown>DEFAULT11
          nanosleep.symtab0x41331084FUNC<unknown>DEFAULT3
          nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          next_start.1065.symtab0x463af04OBJECT<unknown>DEFAULT14
          ngPid.symtab0x45da6c4OBJECT<unknown>DEFAULT13
          ntohl.symtab0x4107108FUNC<unknown>DEFAULT3
          ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          ntohs.symtab0x4107188FUNC<unknown>DEFAULT3
          ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          numpids.symtab0x45dab88OBJECT<unknown>DEFAULT14
          object.2349.symtab0x45da9424OBJECT<unknown>DEFAULT14
          open.symtab0x40e070124FUNC<unknown>DEFAULT3
          open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          ourIP.symtab0x45da684OBJECT<unknown>DEFAULT13
          p.2294.symtab0x45d0900OBJECT<unknown>DEFAULT11
          parseHex.symtab0x402728176FUNC<unknown>DEFAULT3
          pids.symtab0x45da744OBJECT<unknown>DEFAULT13
          pipe.symtab0x40dac064FUNC<unknown>DEFAULT3
          poll.symtab0x415db084FUNC<unknown>DEFAULT3
          poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          prctl.symtab0x40e110120FUNC<unknown>DEFAULT3
          prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          prefix.4045.symtab0x41bea012OBJECT<unknown>DEFAULT5
          print.symtab0x40171c1456FUNC<unknown>DEFAULT3
          printchar.symtab0x401190184FUNC<unknown>DEFAULT3
          printi.symtab0x401484664FUNC<unknown>DEFAULT3
          prints.symtab0x401248572FUNC<unknown>DEFAULT3
          processCmd.symtab0x406bf411596FUNC<unknown>DEFAULT3
          qual_chars.4050.symtab0x41bec020OBJECT<unknown>DEFAULT5
          raise.symtab0x4181b076FUNC<unknown>DEFAULT3
          raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand.symtab0x411be028FUNC<unknown>DEFAULT3
          rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          rand__str.symtab0x40af4c372FUNC<unknown>DEFAULT3
          rand_alpha_str.symtab0x40b0c0300FUNC<unknown>DEFAULT3
          rand_alphastr.symtab0x400fc0464FUNC<unknown>DEFAULT3
          rand_cmwc.symtab0x400dec468FUNC<unknown>DEFAULT3
          rand_init.symtab0x40ad30248FUNC<unknown>DEFAULT3
          rand_next.symtab0x40ae28292FUNC<unknown>DEFAULT3
          random.symtab0x411c00164FUNC<unknown>DEFAULT3
          random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          random_poly_info.symtab0x41cb6040OBJECT<unknown>DEFAULT5
          random_r.symtab0x41200c176FUNC<unknown>DEFAULT3
          random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          randtbl.symtab0x45d428128OBJECT<unknown>DEFAULT11
          rawmemchr.symtab0x416d40200FUNC<unknown>DEFAULT3
          rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          read.symtab0x40e19084FUNC<unknown>DEFAULT3
          read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          realloc.symtab0x4116c0472FUNC<unknown>DEFAULT3
          realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          recv.symtab0x410da084FUNC<unknown>DEFAULT3
          recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          recvLine.symtab0x402cb8876FUNC<unknown>DEFAULT3
          recvfrom.symtab0x410e00128FUNC<unknown>DEFAULT3
          recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          resolv_domain_to_hostname.symtab0x40b1f0360FUNC<unknown>DEFAULT3
          resolv_entries_free.symtab0x40be84164FUNC<unknown>DEFAULT3
          resolv_lookup.symtab0x40b49c2536FUNC<unknown>DEFAULT3
          resolv_skip_name.symtab0x40b358324FUNC<unknown>DEFAULT3
          rtcp.symtab0x404d701748FUNC<unknown>DEFAULT3
          sbrk.symtab0x413370144FUNC<unknown>DEFAULT3
          sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          scanPid.symtab0x45da704OBJECT<unknown>DEFAULT13
          select.symtab0x40e1f0120FUNC<unknown>DEFAULT3
          select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          send.symtab0x410e8084FUNC<unknown>DEFAULT3
          send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sendSTD.symtab0x405444720FUNC<unknown>DEFAULT3
          sendto.symtab0x410ee0128FUNC<unknown>DEFAULT3
          sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setsockopt.symtab0x410f60120FUNC<unknown>DEFAULT3
          setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          setstate.symtab0x411ca4176FUNC<unknown>DEFAULT3
          setstate_r.symtab0x411ed0316FUNC<unknown>DEFAULT3
          sigaction.symtab0x413040232FUNC<unknown>DEFAULT3
          sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigaddset.symtab0x411040104FUNC<unknown>DEFAULT3
          sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigemptyset.symtab0x4110b060FUNC<unknown>DEFAULT3
          signal.symtab0x4110f0252FUNC<unknown>DEFAULT3
          signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigprocmask.symtab0x40e270148FUNC<unknown>DEFAULT3
          sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          sleep.symtab0x4127d0564FUNC<unknown>DEFAULT3
          sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          socket.symtab0x410fe084FUNC<unknown>DEFAULT3
          socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          socket_connect.symtab0x4063b0444FUNC<unknown>DEFAULT3
          sockprintf.symtab0x401dbc344FUNC<unknown>DEFAULT3
          spec_and_mask.4049.symtab0x41bed416OBJECT<unknown>DEFAULT5
          spec_base.4044.symtab0x41beac7OBJECT<unknown>DEFAULT5
          spec_chars.4046.symtab0x41bf0021OBJECT<unknown>DEFAULT5
          spec_flags.4045.symtab0x41bf188OBJECT<unknown>DEFAULT5
          spec_or_mask.4048.symtab0x41bee416OBJECT<unknown>DEFAULT5
          spec_ranges.4047.symtab0x41bef49OBJECT<unknown>DEFAULT5
          sprintf.symtab0x40e4e080FUNC<unknown>DEFAULT3
          sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          srand.symtab0x411e24172FUNC<unknown>DEFAULT3
          srandom.symtab0x411e24172FUNC<unknown>DEFAULT3
          srandom_r.symtab0x4120bc372FUNC<unknown>DEFAULT3
          static_id.symtab0x45d5002OBJECT<unknown>DEFAULT11
          static_ns.symtab0x463d584OBJECT<unknown>DEFAULT14
          stderr.symtab0x45d1e84OBJECT<unknown>DEFAULT11
          stdin.symtab0x45d1e04OBJECT<unknown>DEFAULT11
          stdout.symtab0x45d1e44OBJECT<unknown>DEFAULT11
          strcasecmp.symtab0x418480108FUNC<unknown>DEFAULT3
          strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strchr.symtab0x40ff00256FUNC<unknown>DEFAULT3
          strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strcmp.symtab0x41000044FUNC<unknown>DEFAULT3
          strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strcoll.symtab0x41000044FUNC<unknown>DEFAULT3
          strcpy.symtab0x41003036FUNC<unknown>DEFAULT3
          strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strdup.symtab0x416f20144FUNC<unknown>DEFAULT3
          strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strerror_r.symtab0x410430392FUNC<unknown>DEFAULT3
          strlen.symtab0x410060184FUNC<unknown>DEFAULT3
          strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strncat.symtab0x416e10180FUNC<unknown>DEFAULT3
          strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strncpy.symtab0x410120188FUNC<unknown>DEFAULT3
          strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strnlen.symtab0x4101e0256FUNC<unknown>DEFAULT3
          strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strpbrk.symtab0x414bc064FUNC<unknown>DEFAULT3
          strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strspn.symtab0x416ed076FUNC<unknown>DEFAULT3
          strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strstr.symtab0x4102e0256FUNC<unknown>DEFAULT3
          strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strtok.symtab0x41060032FUNC<unknown>DEFAULT3
          strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strtok_r.symtab0x414af0204FUNC<unknown>DEFAULT3
          strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          strtol.symtab0x4123a028FUNC<unknown>DEFAULT3
          strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          szprintf.symtab0x401d44120FUNC<unknown>DEFAULT3
          table.symtab0x463d80232OBJECT<unknown>DEFAULT14
          table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          table_init.symtab0x40bf301068FUNC<unknown>DEFAULT3
          table_key.symtab0x45d1704OBJECT<unknown>DEFAULT11
          table_lock_val.symtab0x40c3e0132FUNC<unknown>DEFAULT3
          table_retrieve_val.symtab0x40c464144FUNC<unknown>DEFAULT3
          table_unlock_val.symtab0x40c35c132FUNC<unknown>DEFAULT3
          tcgetattr.symtab0x410660176FUNC<unknown>DEFAULT3
          tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          tcpFl00d.symtab0x4044542332FUNC<unknown>DEFAULT3
          tcpcsum.symtab0x403854356FUNC<unknown>DEFAULT3
          time.symtab0x40e31084FUNC<unknown>DEFAULT3
          time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          times.symtab0x41340084FUNC<unknown>DEFAULT3
          times.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          toggle_obf.symtab0x40c5bc552FUNC<unknown>DEFAULT3
          tolower.symtab0x4182b060FUNC<unknown>DEFAULT3
          tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          toupper.symtab0x40e41060FUNC<unknown>DEFAULT3
          toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          trim.symtab0x400c00492FUNC<unknown>DEFAULT3
          type_codes.symtab0x41bf2024OBJECT<unknown>DEFAULT5
          type_sizes.symtab0x41bf3812OBJECT<unknown>DEFAULT5
          udpfl00d.symtab0x403af02404FUNC<unknown>DEFAULT3
          unknown.1088.symtab0x41bfd014OBJECT<unknown>DEFAULT5
          unsafe_state.symtab0x45d4b028OBJECT<unknown>DEFAULT11
          uppercase.symtab0x402b08164FUNC<unknown>DEFAULT3
          userID.symtab0x45d0c84OBJECT<unknown>DEFAULT11
          usleep.symtab0x412a10144FUNC<unknown>DEFAULT3
          usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          util.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          util_atoi.symtab0x40cd14968FUNC<unknown>DEFAULT3
          util_fdgets.symtab0x40d79c320FUNC<unknown>DEFAULT3
          util_isalpha.symtab0x40d944144FUNC<unknown>DEFAULT3
          util_isdigit.symtab0x40da54104FUNC<unknown>DEFAULT3
          util_isspace.symtab0x40d9d4128FUNC<unknown>DEFAULT3
          util_isupper.symtab0x40d8dc104FUNC<unknown>DEFAULT3
          util_itoa.symtab0x40d0dc572FUNC<unknown>DEFAULT3
          util_local_addr.symtab0x40d648340FUNC<unknown>DEFAULT3
          util_memcpy.symtab0x40cbf8164FUNC<unknown>DEFAULT3
          util_memsearch.symtab0x40d318292FUNC<unknown>DEFAULT3
          util_strcat.symtab0x40cb50168FUNC<unknown>DEFAULT3
          util_strcmp.symtab0x40c9a4288FUNC<unknown>DEFAULT3
          util_strcpy.symtab0x40cac4140FUNC<unknown>DEFAULT3
          util_stristr.symtab0x40d43c524FUNC<unknown>DEFAULT3
          util_strlen.symtab0x40c7f0116FUNC<unknown>DEFAULT3
          util_strncmp.symtab0x40c864320FUNC<unknown>DEFAULT3
          util_zero.symtab0x40cc9c120FUNC<unknown>DEFAULT3
          vfork.symtab0x40e37028FUNC<unknown>DEFAULT3
          vfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          vseattack.symtab0x4058702508FUNC<unknown>DEFAULT3
          vsnprintf.symtab0x40e530260FUNC<unknown>DEFAULT3
          vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          w.symtab0x461adc4OBJECT<unknown>DEFAULT14
          wait4.symtab0x41346088FUNC<unknown>DEFAULT3
          wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          waitpid.symtab0x40e39028FUNC<unknown>DEFAULT3
          waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          watchdog_maintain.symtab0x4008a0564FUNC<unknown>DEFAULT3
          watchdog_pid.symtab0x45dab44OBJECT<unknown>DEFAULT14
          wcrtomb.symtab0x4134e0112FUNC<unknown>DEFAULT3
          wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          wcsnrtombs.symtab0x413590228FUNC<unknown>DEFAULT3
          wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          wcsrtombs.symtab0x41355064FUNC<unknown>DEFAULT3
          wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          wildString.symtab0x4027d8656FUNC<unknown>DEFAULT3
          write.symtab0x40e3b084FUNC<unknown>DEFAULT3
          write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
          x.symtab0x461ad04OBJECT<unknown>DEFAULT14
          xdigits.3043.symtab0x41ccc417OBJECT<unknown>DEFAULT5
          y.symtab0x461ad44OBJECT<unknown>DEFAULT14
          z.symtab0x461ad84OBJECT<unknown>DEFAULT14
          zprintf.symtab0x401ccc120FUNC<unknown>DEFAULT3
          TimestampSource PortDest PortSource IPDest IP
          Nov 30, 2022 01:18:52.461908102 CET38500576192.168.2.2347.87.197.232
          Nov 30, 2022 01:18:53.115566015 CET42836443192.168.2.2391.189.91.43
          Nov 30, 2022 01:18:53.883513927 CET4251680192.168.2.23109.202.202.202
          Nov 30, 2022 01:19:08.474720001 CET43928443192.168.2.2391.189.91.42
          Nov 30, 2022 01:19:12.602727890 CET38502576192.168.2.2347.87.197.232
          Nov 30, 2022 01:19:18.714327097 CET42836443192.168.2.2391.189.91.43
          Nov 30, 2022 01:19:24.857873917 CET4251680192.168.2.23109.202.202.202
          Nov 30, 2022 01:19:32.742233038 CET38504576192.168.2.2347.87.197.232
          Nov 30, 2022 01:19:49.432646990 CET43928443192.168.2.2391.189.91.42
          Nov 30, 2022 01:19:52.881496906 CET38506576192.168.2.2347.87.197.232
          Nov 30, 2022 01:20:09.911521912 CET42836443192.168.2.2391.189.91.43
          Nov 30, 2022 01:20:13.021069050 CET38508576192.168.2.2347.87.197.232
          Nov 30, 2022 01:20:33.160927057 CET38510576192.168.2.2347.87.197.232
          Nov 30, 2022 01:20:53.300317049 CET38512576192.168.2.2347.87.197.232
          Nov 30, 2022 01:21:13.439568043 CET38514576192.168.2.2347.87.197.232
          Nov 30, 2022 01:21:33.578402996 CET38516576192.168.2.2347.87.197.232
          Nov 30, 2022 01:21:53.717266083 CET38518576192.168.2.2347.87.197.232
          Nov 30, 2022 01:22:13.856544018 CET38520576192.168.2.2347.87.197.232
          TimestampSource IPDest IPChecksumCodeType
          Nov 30, 2022 01:18:52.600905895 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:19:12.741163969 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:19:32.880971909 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:19:53.020415068 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:20:13.160382032 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:20:33.299684048 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:20:53.438926935 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:21:13.578046083 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:21:33.716718912 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:21:53.855829954 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable
          Nov 30, 2022 01:22:13.994982004 CET47.87.197.232192.168.2.23b523(Unknown)Destination Unreachable

          System Behavior

          Start time:01:18:51
          Start date:30/11/2022
          Path:/tmp/yB9hLLnhbx.elf
          Arguments:/tmp/yB9hLLnhbx.elf
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c
          Start time:01:18:52
          Start date:30/11/2022
          Path:/tmp/yB9hLLnhbx.elf
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c
          Start time:01:18:52
          Start date:30/11/2022
          Path:/tmp/yB9hLLnhbx.elf
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c
          Start time:01:18:52
          Start date:30/11/2022
          Path:/tmp/yB9hLLnhbx.elf
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c