Edit tour

Linux Analysis Report
141.11.212.101-mipsel-2025-03-03T07_22_23.elf

Overview

General Information

Sample name:141.11.212.101-mipsel-2025-03-03T07_22_23.elf
Analysis ID:1639920
MD5:1ca7f053b5ad82c75c1efa5b9f4ae977
SHA1:b5eb1f88f1e6b08ccd2e1e1e11f40192f3ed93cf
SHA256:9ca9d5fa97e738bdebe866ce2ae883a8e5ba6a4d6d0a9443b74531f11ccb0673
Tags:elfuser-threatquery
Infos:

Detection

Gafgyt, Mirai
Score:88
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Contains symbols with names commonly found in malware
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1639920
Start date and time:2025-03-16 16:13:16 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:141.11.212.101-mipsel-2025-03-03T07_22_23.elf
Detection:MAL
Classification:mal88.spre.troj.linELF@0/0@2/0
Command:/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
PID:5488
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate alot
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
141.11.212.101-mipsel-2025-03-03T07_22_23.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    141.11.212.101-mipsel-2025-03-03T07_22_23.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      141.11.212.101-mipsel-2025-03-03T07_22_23.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x19bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      SourceRuleDescriptionAuthorStrings
      5488.1.00007f773c400000.00007f773c41e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5488.1.00007f773c400000.00007f773c41e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x19bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        5490.1.00007f773c400000.00007f773c41e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5490.1.00007f773c400000.00007f773c41e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x19bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          5492.1.00007f773c400000.00007f773c41e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
            Click to see the 7 entries
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfAvira: detected
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfReversingLabs: Detection: 61%

            Spreading

            barindex
            Source: /tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf (PID: 5488)Opens: /proc/net/routeJump to behavior
            Source: global trafficTCP traffic: 192.168.2.14:40406 -> 141.11.212.101:820
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownTCP traffic detected without corresponding DNS query: 141.11.212.101
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

            System Summary

            barindex
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5488.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5490.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5492.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5488, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5490, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5492, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: ELF static info symbol of initial sampleName: vseattack
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5488.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5490.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5492.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5488, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5490, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5492, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: classification engineClassification label: mal88.spre.troj.linELF@0/0@2/0
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfELF static info symbol of initial sample: libc/string/mips/memcpy.S
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfELF static info symbol of initial sample: libc/string/mips/memset.S
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S
            Source: /tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf (PID: 5488)Queries kernel information via 'uname': Jump to behavior
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5488.1.00005564cdbc7000.00005564cdc4e000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5490.1.00005564cdbc7000.00005564cdc4e000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5492.1.00005564cdbc7000.00005564cdc4e000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5488.1.00007ffc19b9b000.00007ffc19bbc000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5490.1.00007ffc19b9b000.00007ffc19bbc000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5492.1.00007ffc19b9b000.00007ffc19bbc000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5488.1.00005564cdbc7000.00005564cdc4e000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5490.1.00005564cdbc7000.00005564cdc4e000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5492.1.00005564cdbc7000.00005564cdc4e000.rw-.sdmpBinary or memory string: dU!/etc/qemu-binfmt/mipsel
            Source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5488.1.00007ffc19b9b000.00007ffc19bbc000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5490.1.00007ffc19b9b000.00007ffc19bbc000.rw-.sdmp, 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, 5492.1.00007ffc19b9b000.00007ffc19bbc000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, type: SAMPLE
            Source: Yara matchFile source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, type: SAMPLE
            Source: Yara matchFile source: 5488.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5490.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5492.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5488, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5490, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5492, type: MEMORYSTR
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
            Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, type: SAMPLE
            Source: Yara matchFile source: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf, type: SAMPLE
            Source: Yara matchFile source: 5488.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5490.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5492.1.00007f773c400000.00007f773c41e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5488, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5490, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 141.11.212.101-mipsel-2025-03-03T07_22_23.elf PID: 5492, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Data Obfuscation
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
            Remote System Discovery
            Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
            Application Layer Protocol
            Traffic DuplicationData Destruction
            No configs have been found
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1639920 Sample: 141.11.212.101-mipsel-2025-... Startdate: 16/03/2025 Architecture: LINUX Score: 88 17 141.11.212.101, 40406, 40408, 40410 FranceTelecom-OrangeFR United Kingdom 2->17 19 daisy.ubuntu.com 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 3 other signatures 2->27 8 141.11.212.101-mipsel-2025-03-03T07_22_23.elf 2->8         started        signatures3 process4 signatures5 29 Opens /proc/net/* files useful for finding connected devices and routers 8->29 11 141.11.212.101-mipsel-2025-03-03T07_22_23.elf 8->11         started        13 141.11.212.101-mipsel-2025-03-03T07_22_23.elf 8->13         started        process6 process7 15 141.11.212.101-mipsel-2025-03-03T07_22_23.elf 11->15         started       

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            141.11.212.101-mipsel-2025-03-03T07_22_23.elf61%ReversingLabsLinux.Trojan.LnxGafgyt
            141.11.212.101-mipsel-2025-03-03T07_22_23.elf100%AviraLINUX/Mirai.Gafgyt.
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            162.213.35.25
            truefalse
              high
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              141.11.212.101
              unknownUnited Kingdom
              3215FranceTelecom-OrangeFRtrue
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              141.11.212.101141.11.212.101-sparc-2025-03-03T07_22_24.elfGet hashmaliciousGafgyt, MiraiBrowse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comEdiAf.ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                EdiAf.arm5.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                EdiAf.mpsl.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                EdiAf.arm6.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                .i.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                .i.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                yakuza.ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                sora.mpsl.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                sora.sh4.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                sora.arm7.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                FranceTelecom-OrangeFRNyx4r.arm.elfGet hashmaliciousOkiruBrowse
                • 90.34.68.220
                sora.ppc.elfGet hashmaliciousMiraiBrowse
                • 92.156.220.251
                sora.mpsl.elfGet hashmaliciousMiraiBrowse
                • 90.4.153.119
                sora.sh4.elfGet hashmaliciousMiraiBrowse
                • 92.170.221.65
                sora.m68k.elfGet hashmaliciousMiraiBrowse
                • 83.118.43.145
                hgfs.arm5.elfGet hashmaliciousUnknownBrowse
                • 90.107.43.114
                hgfs.arm.elfGet hashmaliciousUnknownBrowse
                • 86.253.246.234
                hgfs.mpsl.elfGet hashmaliciousUnknownBrowse
                • 83.195.219.129
                hgfs.arm.elfGet hashmaliciousUnknownBrowse
                • 90.111.104.240
                hgfs.x86.elfGet hashmaliciousUnknownBrowse
                • 81.255.36.91
                No context
                No context
                No created / dropped files found
                File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                Entropy (8bit):5.321682587662445
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:141.11.212.101-mipsel-2025-03-03T07_22_23.elf
                File size:155'476 bytes
                MD5:1ca7f053b5ad82c75c1efa5b9f4ae977
                SHA1:b5eb1f88f1e6b08ccd2e1e1e11f40192f3ed93cf
                SHA256:9ca9d5fa97e738bdebe866ce2ae883a8e5ba6a4d6d0a9443b74531f11ccb0673
                SHA512:9597e0377c36150a9d02ceb6dffee0b55ffabcaec3131ff620cf8f2313cc674584bbb45789329fc09f107bc60ca6e2d72b6066ab267cdd7ac14b4f65a98ebcaf
                SSDEEP:3072:dgZc9h1jlnLA2PiXYeyCc2VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ2VWDo9mrThPaLEnvP5
                TLSH:64E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48
                File Content Preview:.ELF......................@.4...4.......4. ...(........p......@...@...........................@...@.D...D...............D...D.E.D.E.P....o..........Q.td.................................................UF....<.T.'!......'.......................<.T.'!... ..

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:MIPS R3000
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x4002a0
                Flags:0x1007
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:4
                Section Header Offset:133172
                Section Header Size:40
                Number of Section Headers:21
                Header String Table Index:18
                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .reginfoMIPS_REGINFO0x4000b40xb40x180x180x2A004
                .initPROGBITS0x4000cc0xcc0x8c0x00x6AX004
                .textPROGBITS0x4001600x1600x188e00x00x6AX0016
                .finiPROGBITS0x418a400x18a400x5c0x00x6AX004
                .rodataPROGBITS0x418aa00x18aa00x45a00x00x2A0016
                .eh_framePROGBITS0x41d0400x1d0400x40x00x2A004
                .ctorsPROGBITS0x45d0440x1d0440x80x00x3WA004
                .dtorsPROGBITS0x45d04c0x1d04c0x80x00x3WA004
                .jcrPROGBITS0x45d0540x1d0540x40x00x3WA004
                .data.rel.roPROGBITS0x45d0580x1d0580x4c0x00x3WA004
                .dataPROGBITS0x45d0b00x1d0b00x4e00x00x3WA0016
                .gotPROGBITS0x45d5900x1d5900x5040x40x10000003WAp0016
                .sbssNOBITS0x45da940x1da940x240x00x10000003WAp004
                .bssNOBITS0x45dac00x1da940x648c0x00x3WA0016
                .commentPROGBITS0x00x1da940xbe20x00x0001
                .mdebug.abi32PROGBITS0xbe20x1e6760x00x00x0001
                .pdrPROGBITS0x00x1e6780x21200x00x0004
                .shstrtabSTRTAB0x00x207980x9a0x00x0001
                .symtabSYMTAB0x00x20b7c0x30300x100x0203214
                .strtabSTRTAB0x00x23bac0x23a80x00x0001
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                <unknown>0xb40x4000b40x4000b40x180x180.98340x4R 0x4.reginfo
                LOAD0x00x4000000x4000000x1d0440x1d0445.31150x5R E0x10000.reginfo .init .text .fini .rodata .eh_frame
                LOAD0x1d0440x45d0440x45d0440xa500x6f084.15530x6RW 0x10000.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                .symtab0x4000b40SECTION<unknown>DEFAULT1
                .symtab0x4000cc0SECTION<unknown>DEFAULT2
                .symtab0x4001600SECTION<unknown>DEFAULT3
                .symtab0x418a400SECTION<unknown>DEFAULT4
                .symtab0x418aa00SECTION<unknown>DEFAULT5
                .symtab0x41d0400SECTION<unknown>DEFAULT6
                .symtab0x45d0440SECTION<unknown>DEFAULT7
                .symtab0x45d04c0SECTION<unknown>DEFAULT8
                .symtab0x45d0540SECTION<unknown>DEFAULT9
                .symtab0x45d0580SECTION<unknown>DEFAULT10
                .symtab0x45d0b00SECTION<unknown>DEFAULT11
                .symtab0x45d5900SECTION<unknown>DEFAULT12
                .symtab0x45da940SECTION<unknown>DEFAULT13
                .symtab0x45dac00SECTION<unknown>DEFAULT14
                .symtab0x00SECTION<unknown>DEFAULT15
                .symtab0xbe20SECTION<unknown>DEFAULT16
                .symtab0x00SECTION<unknown>DEFAULT17
                .symtab0x00SECTION<unknown>DEFAULT18
                .symtab0x00SECTION<unknown>DEFAULT19
                .symtab0x00SECTION<unknown>DEFAULT20
                C.151.5648.symtab0x45d05840OBJECT<unknown>DEFAULT10
                C.182.5940.symtab0x45d09416OBJECT<unknown>DEFAULT10
                C.183.5941.symtab0x45d08020OBJECT<unknown>DEFAULT10
                KHcommSOCK.symtab0x45dae04OBJECT<unknown>DEFAULT14
                KHserverHACKER.symtab0x45d0f44OBJECT<unknown>DEFAULT11
                LOCAL_ADDR.symtab0x45da944OBJECT<unknown>DEFAULT13
                Q.symtab0x45dafc16384OBJECT<unknown>DEFAULT14
                UserAgents.symtab0x45d110144OBJECT<unknown>DEFAULT11
                _GLOBAL_OFFSET_TABLE_.symtab0x45d5900OBJECT<unknown>DEFAULT12
                _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __CTOR_END__.symtab0x45d0480OBJECT<unknown>DEFAULT7
                __CTOR_LIST__.symtab0x45d0440OBJECT<unknown>DEFAULT7
                __C_ctype_b.symtab0x45d1b04OBJECT<unknown>DEFAULT11
                __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_b_data.symtab0x41b8a0768OBJECT<unknown>DEFAULT5
                __C_ctype_tolower.symtab0x45d5804OBJECT<unknown>DEFAULT11
                __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_tolower_data.symtab0x41cd40768OBJECT<unknown>DEFAULT5
                __C_ctype_toupper.symtab0x45d1c04OBJECT<unknown>DEFAULT11
                __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __C_ctype_toupper_data.symtab0x41bba0768OBJECT<unknown>DEFAULT5
                __DTOR_END__.symtab0x45d0500OBJECT<unknown>DEFAULT8
                __DTOR_LIST__.symtab0x45d04c0OBJECT<unknown>DEFAULT8
                __EH_FRAME_BEGIN__.symtab0x41d0400OBJECT<unknown>DEFAULT6
                __FRAME_END__.symtab0x41d0400OBJECT<unknown>DEFAULT6
                __GI___C_ctype_b.symtab0x45d1b04OBJECT<unknown>HIDDEN11
                __GI___C_ctype_b_data.symtab0x41b8a0768OBJECT<unknown>HIDDEN5
                __GI___C_ctype_tolower.symtab0x45d5804OBJECT<unknown>HIDDEN11
                __GI___C_ctype_tolower_data.symtab0x41cd40768OBJECT<unknown>HIDDEN5
                __GI___C_ctype_toupper.symtab0x45d1c04OBJECT<unknown>HIDDEN11
                __GI___C_ctype_toupper_data.symtab0x41bba0768OBJECT<unknown>HIDDEN5
                __GI___ctype_b.symtab0x45d1b44OBJECT<unknown>HIDDEN11
                __GI___ctype_tolower.symtab0x45d5844OBJECT<unknown>HIDDEN11
                __GI___ctype_toupper.symtab0x45d1c44OBJECT<unknown>HIDDEN11
                __GI___errno_location.symtab0x40e41024FUNC<unknown>HIDDEN3
                __GI___fgetc_unlocked.symtab0x418320388FUNC<unknown>HIDDEN3
                __GI___glibc_strerror_r.symtab0x4103a068FUNC<unknown>HIDDEN3
                __GI___h_errno_location.symtab0x4134e024FUNC<unknown>HIDDEN3
                __GI___libc_fcntl.symtab0x40dac0136FUNC<unknown>HIDDEN3
                __GI___libc_fcntl64.symtab0x40db50104FUNC<unknown>HIDDEN3
                __GI___libc_open.symtab0x40e030124FUNC<unknown>HIDDEN3
                __GI___uClibc_fini.symtab0x412ac0196FUNC<unknown>HIDDEN3
                __GI___uClibc_init.symtab0x412c1c140FUNC<unknown>HIDDEN3
                __GI___xpg_strerror_r.symtab0x4103f0392FUNC<unknown>HIDDEN3
                __GI__exit.symtab0x40dbc080FUNC<unknown>HIDDEN3
                __GI_abort.symtab0x415ba0428FUNC<unknown>HIDDEN3
                __GI_atoi.symtab0x4123a028FUNC<unknown>HIDDEN3
                __GI_atol.symtab0x4123a028FUNC<unknown>HIDDEN3
                __GI_brk.symtab0x415d80112FUNC<unknown>HIDDEN3
                __GI_close.symtab0x40dc7084FUNC<unknown>HIDDEN3
                __GI_connect.symtab0x410c8084FUNC<unknown>HIDDEN3
                __GI_dup2.symtab0x40dcd084FUNC<unknown>HIDDEN3
                __GI_errno.symtab0x463d604OBJECT<unknown>HIDDEN14
                __GI_execl.symtab0x412720204FUNC<unknown>HIDDEN3
                __GI_execve.symtab0x4131b084FUNC<unknown>HIDDEN3
                __GI_exit.symtab0x412630236FUNC<unknown>HIDDEN3
                __GI_fclose.symtab0x415e50512FUNC<unknown>HIDDEN3
                __GI_fcntl.symtab0x40dac0136FUNC<unknown>HIDDEN3
                __GI_fcntl64.symtab0x40db50104FUNC<unknown>HIDDEN3
                __GI_fflush_unlocked.symtab0x4169e0628FUNC<unknown>HIDDEN3
                __GI_fgetc_unlocked.symtab0x418320388FUNC<unknown>HIDDEN3
                __GI_fgets.symtab0x416770216FUNC<unknown>HIDDEN3
                __GI_fgets_unlocked.symtab0x416c60268FUNC<unknown>HIDDEN3
                __GI_fopen.symtab0x41605028FUNC<unknown>HIDDEN3
                __GI_fork.symtab0x40dd3084FUNC<unknown>HIDDEN3
                __GI_fputs_unlocked.symtab0x40fb50128FUNC<unknown>HIDDEN3
                __GI_fseek.symtab0x41607068FUNC<unknown>HIDDEN3
                __GI_fseeko64.symtab0x4160c0388FUNC<unknown>HIDDEN3
                __GI_fwrite_unlocked.symtab0x40fbd0280FUNC<unknown>HIDDEN3
                __GI_getc_unlocked.symtab0x418320388FUNC<unknown>HIDDEN3
                __GI_getdtablesize.symtab0x40dd9072FUNC<unknown>HIDDEN3
                __GI_getegid.symtab0x41321088FUNC<unknown>HIDDEN3
                __GI_geteuid.symtab0x40dde088FUNC<unknown>HIDDEN3
                __GI_getgid.symtab0x41327084FUNC<unknown>HIDDEN3
                __GI_gethostbyname.symtab0x4107a0116FUNC<unknown>HIDDEN3
                __GI_gethostbyname_r.symtab0x4108201108FUNC<unknown>HIDDEN3
                __GI_getpid.symtab0x40de4084FUNC<unknown>HIDDEN3
                __GI_getrlimit.symtab0x40df0084FUNC<unknown>HIDDEN3
                __GI_getsockname.symtab0x410ce084FUNC<unknown>HIDDEN3
                __GI_getuid.symtab0x4132d084FUNC<unknown>HIDDEN3
                __GI_h_errno.symtab0x463d644OBJECT<unknown>HIDDEN14
                __GI_inet_addr.symtab0x41075072FUNC<unknown>HIDDEN3
                __GI_inet_aton.symtab0x414c20280FUNC<unknown>HIDDEN3
                __GI_inet_ntop.symtab0x417580852FUNC<unknown>HIDDEN3
                __GI_inet_pton.symtab0x4170d0700FUNC<unknown>HIDDEN3
                __GI_initstate_r.symtab0x412250328FUNC<unknown>HIDDEN3
                __GI_ioctl.symtab0x40df60104FUNC<unknown>HIDDEN3
                __GI_isatty.symtab0x4105e060FUNC<unknown>HIDDEN3
                __GI_kill.symtab0x40dfd088FUNC<unknown>HIDDEN3
                __GI_lseek64.symtab0x418230164FUNC<unknown>HIDDEN3
                __GI_memchr.symtab0x414570264FUNC<unknown>HIDDEN3
                __GI_memcpy.symtab0x40fcf0308FUNC<unknown>HIDDEN3
                __GI_memmove.symtab0x414680816FUNC<unknown>HIDDEN3
                __GI_mempcpy.symtab0x4149b076FUNC<unknown>HIDDEN3
                __GI_memrchr.symtab0x414a00272FUNC<unknown>HIDDEN3
                __GI_memset.symtab0x40fe30144FUNC<unknown>HIDDEN3
                __GI_nanosleep.symtab0x41333084FUNC<unknown>HIDDEN3
                __GI_open.symtab0x40e030124FUNC<unknown>HIDDEN3
                __GI_pipe.symtab0x40da8064FUNC<unknown>HIDDEN3
                __GI_poll.symtab0x415df084FUNC<unknown>HIDDEN3
                __GI_raise.symtab0x4181e076FUNC<unknown>HIDDEN3
                __GI_random.symtab0x411c20164FUNC<unknown>HIDDEN3
                __GI_random_r.symtab0x41202c176FUNC<unknown>HIDDEN3
                __GI_rawmemchr.symtab0x416d70200FUNC<unknown>HIDDEN3
                __GI_read.symtab0x40e15084FUNC<unknown>HIDDEN3
                __GI_recv.symtab0x410dc084FUNC<unknown>HIDDEN3
                __GI_recvfrom.symtab0x410e20128FUNC<unknown>HIDDEN3
                __GI_sbrk.symtab0x413390144FUNC<unknown>HIDDEN3
                __GI_select.symtab0x40e1b0120FUNC<unknown>HIDDEN3
                __GI_send.symtab0x410ea084FUNC<unknown>HIDDEN3
                __GI_sendto.symtab0x410f00128FUNC<unknown>HIDDEN3
                __GI_setsockopt.symtab0x410f80120FUNC<unknown>HIDDEN3
                __GI_setstate_r.symtab0x411ef0316FUNC<unknown>HIDDEN3
                __GI_sigaction.symtab0x413060232FUNC<unknown>HIDDEN3
                __GI_sigaddset.symtab0x411060104FUNC<unknown>HIDDEN3
                __GI_sigemptyset.symtab0x4110d060FUNC<unknown>HIDDEN3
                __GI_signal.symtab0x411110252FUNC<unknown>HIDDEN3
                __GI_sigprocmask.symtab0x40e230148FUNC<unknown>HIDDEN3
                __GI_sleep.symtab0x4127f0564FUNC<unknown>HIDDEN3
                __GI_socket.symtab0x41100084FUNC<unknown>HIDDEN3
                __GI_sprintf.symtab0x40e4a080FUNC<unknown>HIDDEN3
                __GI_srandom_r.symtab0x4120dc372FUNC<unknown>HIDDEN3
                __GI_strcasecmp.symtab0x4184b0108FUNC<unknown>HIDDEN3
                __GI_strchr.symtab0x40fec0256FUNC<unknown>HIDDEN3
                __GI_strcmp.symtab0x40ffc044FUNC<unknown>HIDDEN3
                __GI_strcoll.symtab0x40ffc044FUNC<unknown>HIDDEN3
                __GI_strcpy.symtab0x40fff036FUNC<unknown>HIDDEN3
                __GI_strdup.symtab0x416f50144FUNC<unknown>HIDDEN3
                __GI_strlen.symtab0x410020184FUNC<unknown>HIDDEN3
                __GI_strncat.symtab0x416e40180FUNC<unknown>HIDDEN3
                __GI_strncpy.symtab0x4100e0188FUNC<unknown>HIDDEN3
                __GI_strnlen.symtab0x4101a0256FUNC<unknown>HIDDEN3
                __GI_strpbrk.symtab0x414be064FUNC<unknown>HIDDEN3
                __GI_strspn.symtab0x416f0076FUNC<unknown>HIDDEN3
                __GI_strstr.symtab0x4102a0256FUNC<unknown>HIDDEN3
                __GI_strtok.symtab0x4105c032FUNC<unknown>HIDDEN3
                __GI_strtok_r.symtab0x414b10204FUNC<unknown>HIDDEN3
                __GI_strtol.symtab0x4123c028FUNC<unknown>HIDDEN3
                __GI_tcgetattr.symtab0x410620176FUNC<unknown>HIDDEN3
                __GI_time.symtab0x40e2d084FUNC<unknown>HIDDEN3
                __GI_times.symtab0x41342084FUNC<unknown>HIDDEN3
                __GI_tolower.symtab0x4182e060FUNC<unknown>HIDDEN3
                __GI_toupper.symtab0x40e3d060FUNC<unknown>HIDDEN3
                __GI_vfork.symtab0x40e33028FUNC<unknown>HIDDEN3
                __GI_vsnprintf.symtab0x40e4f0260FUNC<unknown>HIDDEN3
                __GI_wait4.symtab0x41348088FUNC<unknown>HIDDEN3
                __GI_waitpid.symtab0x40e35028FUNC<unknown>HIDDEN3
                __GI_wcrtomb.symtab0x413500112FUNC<unknown>HIDDEN3
                __GI_wcsnrtombs.symtab0x4135b0228FUNC<unknown>HIDDEN3
                __GI_wcsrtombs.symtab0x41357064FUNC<unknown>HIDDEN3
                __GI_write.symtab0x40e37084FUNC<unknown>HIDDEN3
                __JCR_END__.symtab0x45d0540OBJECT<unknown>DEFAULT9
                __JCR_LIST__.symtab0x45d0540OBJECT<unknown>DEFAULT9
                __app_fini.symtab0x463d4c4OBJECT<unknown>HIDDEN14
                __atexit_lock.symtab0x45d50024OBJECT<unknown>DEFAULT11
                __bsd_signal.symtab0x411110252FUNC<unknown>HIDDEN3
                __bss_start.symtab0x45da940NOTYPE<unknown>DEFAULTSHN_ABS
                __check_one_fd.symtab0x412b94136FUNC<unknown>DEFAULT3
                __ctype_b.symtab0x45d1b44OBJECT<unknown>DEFAULT11
                __ctype_tolower.symtab0x45d5844OBJECT<unknown>DEFAULT11
                __ctype_toupper.symtab0x45d1c44OBJECT<unknown>DEFAULT11
                __curbrk.symtab0x463da04OBJECT<unknown>HIDDEN14
                __data_start.symtab0x45d0d00OBJECT<unknown>DEFAULT11
                __decode_answer.symtab0x417be0340FUNC<unknown>HIDDEN3
                __decode_dotted.symtab0x418640340FUNC<unknown>HIDDEN3
                __decode_header.symtab0x4179f0228FUNC<unknown>HIDDEN3
                __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                __dns_lookup.symtab0x414d402568FUNC<unknown>HIDDEN3
                __do_global_ctors_aux.symtab0x4189d00FUNC<unknown>DEFAULT3
                __do_global_dtors_aux.symtab0x4001600FUNC<unknown>DEFAULT3
                __dso_handle.symtab0x45d0b00OBJECT<unknown>HIDDEN11
                __encode_dotted.symtab0x418520280FUNC<unknown>HIDDEN3
                __encode_header.symtab0x4178e0272FUNC<unknown>HIDDEN3
                __encode_question.symtab0x417ae0172FUNC<unknown>HIDDEN3
                __environ.symtab0x463d444OBJECT<unknown>DEFAULT14
                __errno_location.symtab0x40e41024FUNC<unknown>DEFAULT3
                __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __exit_cleanup.symtab0x463d304OBJECT<unknown>HIDDEN14
                __fgetc_unlocked.symtab0x418320388FUNC<unknown>DEFAULT3
                __fini_array_end.symtab0x45d0440NOTYPE<unknown>HIDDENSHN_ABS
                __fini_array_start.symtab0x45d0440NOTYPE<unknown>HIDDENSHN_ABS
                __get_hosts_byname_r.symtab0x415b30104FUNC<unknown>HIDDEN3
                __glibc_strerror_r.symtab0x4103a068FUNC<unknown>DEFAULT3
                __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __h_errno_location.symtab0x4134e024FUNC<unknown>DEFAULT3
                __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __heap_alloc.symtab0x4118c0188FUNC<unknown>DEFAULT3
                __heap_alloc_at.symtab0x411980184FUNC<unknown>DEFAULT3
                __heap_free.symtab0x411a88364FUNC<unknown>DEFAULT3
                __heap_link_free_area.symtab0x411a4044FUNC<unknown>DEFAULT3
                __heap_link_free_area_after.symtab0x411a6c28FUNC<unknown>DEFAULT3
                __init_array_end.symtab0x45d0440NOTYPE<unknown>HIDDENSHN_ABS
                __init_array_start.symtab0x45d0440NOTYPE<unknown>HIDDENSHN_ABS
                __length_dotted.symtab0x4187a072FUNC<unknown>HIDDEN3
                __length_question.symtab0x417b9072FUNC<unknown>HIDDEN3
                __libc_close.symtab0x40dc7084FUNC<unknown>DEFAULT3
                __libc_connect.symtab0x410c8084FUNC<unknown>DEFAULT3
                __libc_creat.symtab0x40e0ac28FUNC<unknown>DEFAULT3
                __libc_fcntl.symtab0x40dac0136FUNC<unknown>DEFAULT3
                __libc_fcntl64.symtab0x40db50104FUNC<unknown>DEFAULT3
                __libc_fork.symtab0x40dd3084FUNC<unknown>DEFAULT3
                __libc_getpid.symtab0x40de4084FUNC<unknown>DEFAULT3
                __libc_lseek64.symtab0x418230164FUNC<unknown>DEFAULT3
                __libc_nanosleep.symtab0x41333084FUNC<unknown>DEFAULT3
                __libc_open.symtab0x40e030124FUNC<unknown>DEFAULT3
                __libc_poll.symtab0x415df084FUNC<unknown>DEFAULT3
                __libc_read.symtab0x40e15084FUNC<unknown>DEFAULT3
                __libc_recv.symtab0x410dc084FUNC<unknown>DEFAULT3
                __libc_recvfrom.symtab0x410e20128FUNC<unknown>DEFAULT3
                __libc_select.symtab0x40e1b0120FUNC<unknown>DEFAULT3
                __libc_send.symtab0x410ea084FUNC<unknown>DEFAULT3
                __libc_sendto.symtab0x410f00128FUNC<unknown>DEFAULT3
                __libc_sigaction.symtab0x413060232FUNC<unknown>DEFAULT3
                __libc_stack_end.symtab0x463d404OBJECT<unknown>DEFAULT14
                __libc_waitpid.symtab0x40e35028FUNC<unknown>DEFAULT3
                __libc_write.symtab0x40e37084FUNC<unknown>DEFAULT3
                __malloc_heap.symtab0x45d4304OBJECT<unknown>DEFAULT11
                __malloc_heap_lock.symtab0x463d1024OBJECT<unknown>DEFAULT14
                __malloc_sbrk_lock.symtab0x463f1824OBJECT<unknown>DEFAULT14
                __nameserver.symtab0x463f4012OBJECT<unknown>HIDDEN14
                __nameservers.symtab0x45daa84OBJECT<unknown>HIDDEN13
                __open_etc_hosts.symtab0x417d40108FUNC<unknown>HIDDEN3
                __open_nameservers.symtab0x415750984FUNC<unknown>HIDDEN3
                __pagesize.symtab0x463d484OBJECT<unknown>DEFAULT14
                __preinit_array_end.symtab0x45d0440NOTYPE<unknown>HIDDENSHN_ABS
                __preinit_array_start.symtab0x45d0440NOTYPE<unknown>HIDDENSHN_ABS
                __pthread_initialize_minimal.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                __pthread_mutex_init.symtab0x412b848FUNC<unknown>DEFAULT3
                __pthread_mutex_lock.symtab0x412b848FUNC<unknown>DEFAULT3
                __pthread_mutex_trylock.symtab0x412b848FUNC<unknown>DEFAULT3
                __pthread_mutex_unlock.symtab0x412b848FUNC<unknown>DEFAULT3
                __pthread_return_0.symtab0x412b848FUNC<unknown>DEFAULT3
                __pthread_return_void.symtab0x412b8c8FUNC<unknown>DEFAULT3
                __raise.symtab0x4181e076FUNC<unknown>HIDDEN3
                __read_etc_hosts_r.symtab0x417dac1076FUNC<unknown>HIDDEN3
                __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                __resolv_lock.symtab0x45d54024OBJECT<unknown>DEFAULT11
                __rtld_fini.symtab0x463d504OBJECT<unknown>HIDDEN14
                __searchdomain.symtab0x463f3016OBJECT<unknown>HIDDEN14
                __searchdomains.symtab0x45daac4OBJECT<unknown>HIDDEN13
                __sigaddset.symtab0x41123844FUNC<unknown>DEFAULT3
                __sigdelset.symtab0x41126448FUNC<unknown>DEFAULT3
                __sigismember.symtab0x41121040FUNC<unknown>DEFAULT3
                __start.symtab0x4002a0100FUNC<unknown>DEFAULT3
                __stdin.symtab0x45d21c4OBJECT<unknown>DEFAULT11
                __stdio_READ.symtab0x4187f0140FUNC<unknown>HIDDEN3
                __stdio_WRITE.symtab0x4136a0280FUNC<unknown>HIDDEN3
                __stdio_adjust_position.symtab0x416250320FUNC<unknown>HIDDEN3
                __stdio_fwrite.symtab0x4137c0472FUNC<unknown>HIDDEN3
                __stdio_init_mutex.symtab0x40e6b832FUNC<unknown>HIDDEN3
                __stdio_mutex_initializer.3833.symtab0x41bea024OBJECT<unknown>DEFAULT5
                __stdio_rfill.symtab0x41888088FUNC<unknown>HIDDEN3
                __stdio_seek.symtab0x416700112FUNC<unknown>HIDDEN3
                __stdio_trans2r_o.symtab0x4188e0228FUNC<unknown>HIDDEN3
                __stdio_trans2w_o.symtab0x4139a0308FUNC<unknown>HIDDEN3
                __stdio_wcommit.symtab0x40e800100FUNC<unknown>HIDDEN3
                __stdout.symtab0x45d2204OBJECT<unknown>DEFAULT11
                __syscall_error.symtab0x41301072FUNC<unknown>HIDDEN3
                __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __syscall_rt_sigaction.symtab0x41315084FUNC<unknown>HIDDEN3
                __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uClibc_fini.symtab0x412ac0196FUNC<unknown>DEFAULT3
                __uClibc_init.symtab0x412c1c140FUNC<unknown>DEFAULT3
                __uClibc_main.symtab0x412ca8864FUNC<unknown>DEFAULT3
                __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                __uclibc_progname.symtab0x45d5204OBJECT<unknown>HIDDEN11
                __vfork.symtab0x40e33028FUNC<unknown>HIDDEN3
                __xpg_strerror_r.symtab0x4103f0392FUNC<unknown>DEFAULT3
                __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _charpad.symtab0x40e870128FUNC<unknown>DEFAULT3
                _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _dl_aux_init.symtab0x415d5044FUNC<unknown>DEFAULT3
                _dl_phdr.symtab0x45dab04OBJECT<unknown>DEFAULT13
                _dl_phnum.symtab0x45dab44OBJECT<unknown>DEFAULT13
                _edata.symtab0x45da940NOTYPE<unknown>DEFAULTSHN_ABS
                _end.symtab0x463f4c0NOTYPE<unknown>DEFAULTSHN_ABS
                _errno.symtab0x463d604OBJECT<unknown>DEFAULT14
                _exit.symtab0x40dbc080FUNC<unknown>DEFAULT3
                _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fbss.symtab0x45da940NOTYPE<unknown>DEFAULTSHN_ABS
                _fdata.symtab0x45d0b00NOTYPE<unknown>DEFAULT11
                _fini.symtab0x418a4028FUNC<unknown>DEFAULT4
                _fixed_buffers.symtab0x461b188192OBJECT<unknown>DEFAULT14
                _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _fp_out_narrow.symtab0x40e8f0228FUNC<unknown>DEFAULT3
                _fpmaxtostr.symtab0x413d202120FUNC<unknown>HIDDEN3
                _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ftext.symtab0x4001600NOTYPE<unknown>DEFAULT3
                _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _gp.symtab0x4655800NOTYPE<unknown>DEFAULTSHN_ABS
                _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                _h_errno.symtab0x463d644OBJECT<unknown>DEFAULT14
                _init.symtab0x4000cc28FUNC<unknown>DEFAULT2
                _load_inttype.symtab0x413ae0136FUNC<unknown>HIDDEN3
                _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_init.symtab0x40f180220FUNC<unknown>HIDDEN3
                _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_parsespec.symtab0x40f55c1512FUNC<unknown>HIDDEN3
                _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_prepargs.symtab0x40f260100FUNC<unknown>HIDDEN3
                _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _ppfs_setargs.symtab0x40f2d0544FUNC<unknown>HIDDEN3
                _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _promoted_size.symtab0x40f4f0108FUNC<unknown>DEFAULT3
                _pthread_cleanup_pop_restore.symtab0x412b8c8FUNC<unknown>DEFAULT3
                _pthread_cleanup_push_defer.symtab0x412b8c8FUNC<unknown>DEFAULT3
                _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _sigintr.symtab0x463e98128OBJECT<unknown>HIDDEN14
                _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _stdio_fopen.symtab0x416390880FUNC<unknown>HIDDEN3
                _stdio_init.symtab0x40e600184FUNC<unknown>HIDDEN3
                _stdio_openlist.symtab0x45d2244OBJECT<unknown>DEFAULT11
                _stdio_openlist_add_lock.symtab0x45d1d024OBJECT<unknown>DEFAULT11
                _stdio_openlist_dec_use.symtab0x416850400FUNC<unknown>DEFAULT3
                _stdio_openlist_del_count.symtab0x461b144OBJECT<unknown>DEFAULT14
                _stdio_openlist_del_lock.symtab0x45d1e824OBJECT<unknown>DEFAULT11
                _stdio_openlist_use_count.symtab0x461b104OBJECT<unknown>DEFAULT14
                _stdio_streams.symtab0x45d228240OBJECT<unknown>DEFAULT11
                _stdio_term.symtab0x40e6d8284FUNC<unknown>HIDDEN3
                _stdio_user_locking.symtab0x45d2004OBJECT<unknown>DEFAULT11
                _stdlib_strto_l.symtab0x4123e0592FUNC<unknown>HIDDEN3
                _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _store_inttype.symtab0x413b7068FUNC<unknown>HIDDEN3
                _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _string_syserrmsgs.symtab0x41c0102934OBJECT<unknown>HIDDEN5
                _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _uintmaxtostr.symtab0x413bc0340FUNC<unknown>HIDDEN3
                _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _vfprintf_internal.symtab0x40e9d41960FUNC<unknown>HIDDEN3
                _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                abort.symtab0x415ba0428FUNC<unknown>DEFAULT3
                abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                access.symtab0x40dc1084FUNC<unknown>DEFAULT3
                access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                acnc.symtab0x40620c372FUNC<unknown>DEFAULT3
                add_entry.symtab0x40c4b4200FUNC<unknown>DEFAULT3
                atoi.symtab0x4123a028FUNC<unknown>DEFAULT3
                atol.symtab0x4123a028FUNC<unknown>DEFAULT3
                atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                axis_bp.symtab0x45d0f04OBJECT<unknown>DEFAULT11
                bcopy.symtab0x41058032FUNC<unknown>DEFAULT3
                bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                been_there_done_that.symtab0x463d904OBJECT<unknown>DEFAULT14
                been_there_done_that.2792.symtab0x463d544OBJECT<unknown>DEFAULT14
                brk.symtab0x415d80112FUNC<unknown>DEFAULT3
                brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                bsd_signal.symtab0x411110252FUNC<unknown>DEFAULT3
                buf.4833.symtab0x463b30460OBJECT<unknown>DEFAULT14
                bzero.symtab0x4105a028FUNC<unknown>DEFAULT3
                bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                c.symtab0x45d0fc4OBJECT<unknown>DEFAULT11
                calloc.symtab0x411490180FUNC<unknown>DEFAULT3
                calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                checksum_generic.symtab0x400310268FUNC<unknown>DEFAULT3
                checksum_tcp_udp.symtab0x40041c572FUNC<unknown>DEFAULT3
                checksum_tcpudp.symtab0x400658572FUNC<unknown>DEFAULT3
                clock.symtab0x40e430108FUNC<unknown>DEFAULT3
                clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                close.symtab0x40dc7084FUNC<unknown>DEFAULT3
                close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                completed.2296.symtab0x45dac01OBJECT<unknown>DEFAULT14
                connect.symtab0x410c8084FUNC<unknown>DEFAULT3
                connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                connectTimeout.symtab0x403028828FUNC<unknown>DEFAULT3
                creat.symtab0x40e0ac28FUNC<unknown>DEFAULT3
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                csum.symtab0x403688460FUNC<unknown>DEFAULT3
                data_start.symtab0x45d0d00OBJECT<unknown>DEFAULT11
                decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                dup2.symtab0x40dcd084FUNC<unknown>DEFAULT3
                dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                environ.symtab0x463d444OBJECT<unknown>DEFAULT14
                errno.symtab0x463d604OBJECT<unknown>DEFAULT14
                errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                estridx.symtab0x41bf80126OBJECT<unknown>DEFAULT5
                execl.symtab0x412720204FUNC<unknown>DEFAULT3
                execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                execve.symtab0x4131b084FUNC<unknown>DEFAULT3
                execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exit.symtab0x412630236FUNC<unknown>DEFAULT3
                exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                exp10_table.symtab0x41cc2872OBJECT<unknown>DEFAULT5
                fclose.symtab0x415e50512FUNC<unknown>DEFAULT3
                fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fcntl.symtab0x40dac0136FUNC<unknown>DEFAULT3
                fcntl64.symtab0x40db50104FUNC<unknown>DEFAULT3
                fdgets.symtab0x402608292FUNC<unknown>DEFAULT3
                fdopen_pids.symtab0x461afc4OBJECT<unknown>DEFAULT14
                fdpclose.symtab0x40238c636FUNC<unknown>DEFAULT3
                fdpopen.symtab0x401f181140FUNC<unknown>DEFAULT3
                fflush_unlocked.symtab0x4169e0628FUNC<unknown>DEFAULT3
                fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgetc_unlocked.symtab0x418320388FUNC<unknown>DEFAULT3
                fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets.symtab0x416770216FUNC<unknown>DEFAULT3
                fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fgets_unlocked.symtab0x416c60268FUNC<unknown>DEFAULT3
                fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                findRandIP.symtab0x4035dc172FUNC<unknown>DEFAULT3
                fmt.symtab0x41cc1020OBJECT<unknown>DEFAULT5
                fopen.symtab0x41605028FUNC<unknown>DEFAULT3
                fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fork.symtab0x40dd3084FUNC<unknown>DEFAULT3
                fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fputs_unlocked.symtab0x40fb50128FUNC<unknown>DEFAULT3
                fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                frame_dummy.symtab0x40021c0FUNC<unknown>DEFAULT3
                free.symtab0x411550396FUNC<unknown>DEFAULT3
                free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseek.symtab0x41607068FUNC<unknown>DEFAULT3
                fseeko.symtab0x41607068FUNC<unknown>DEFAULT3
                fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fseeko64.symtab0x4160c0388FUNC<unknown>DEFAULT3
                fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                fwrite_unlocked.symtab0x40fbd0280FUNC<unknown>DEFAULT3
                fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getBuild.symtab0x409f5432FUNC<unknown>DEFAULT3
                getHost.symtab0x402a6c160FUNC<unknown>DEFAULT3
                getOurIP.symtab0x409bd4896FUNC<unknown>DEFAULT3
                get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getc_unlocked.symtab0x418320388FUNC<unknown>DEFAULT3
                getdtablesize.symtab0x40dd9072FUNC<unknown>DEFAULT3
                getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getegid.symtab0x41321088FUNC<unknown>DEFAULT3
                getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                geteuid.symtab0x40dde088FUNC<unknown>DEFAULT3
                geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getgid.symtab0x41327084FUNC<unknown>DEFAULT3
                getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname.symtab0x4107a0116FUNC<unknown>DEFAULT3
                gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                gethostbyname_r.symtab0x4108201108FUNC<unknown>DEFAULT3
                gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getpid.symtab0x40de4084FUNC<unknown>DEFAULT3
                getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getppid.symtab0x40dea084FUNC<unknown>DEFAULT3
                getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getrlimit.symtab0x40df0084FUNC<unknown>DEFAULT3
                getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getsockname.symtab0x410ce084FUNC<unknown>DEFAULT3
                getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getsockopt.symtab0x410d40120FUNC<unknown>DEFAULT3
                getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                getuid.symtab0x4132d084FUNC<unknown>DEFAULT3
                getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                h.4832.symtab0x463cfc20OBJECT<unknown>DEFAULT14
                h_errno.symtab0x463d644OBJECT<unknown>DEFAULT14
                hacks.symtab0x45d0e04OBJECT<unknown>DEFAULT11
                hacks2.symtab0x45d0e44OBJECT<unknown>DEFAULT11
                hacks3.symtab0x45d0e84OBJECT<unknown>DEFAULT11
                hacks4.symtab0x45d0ec4OBJECT<unknown>DEFAULT11
                heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                heap_alloc_at.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                hextable.symtab0x4197941024OBJECT<unknown>DEFAULT5
                hlt.symtab0x4002fc0NOTYPE<unknown>DEFAULT3
                htonl.symtab0x41071040FUNC<unknown>DEFAULT3
                htons.symtab0x41073824FUNC<unknown>DEFAULT3
                httphex.symtab0x40653c1672FUNC<unknown>DEFAULT3
                i.4419.symtab0x45d1004OBJECT<unknown>DEFAULT11
                index.symtab0x40fec0256FUNC<unknown>DEFAULT3
                inet_addr.symtab0x41075072FUNC<unknown>DEFAULT3
                inet_aton.symtab0x414c20280FUNC<unknown>DEFAULT3
                inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                inet_ntop.symtab0x417580852FUNC<unknown>DEFAULT3
                inet_ntop4.symtab0x41738c500FUNC<unknown>DEFAULT3
                inet_pton.symtab0x4170d0700FUNC<unknown>DEFAULT3
                inet_pton4.symtab0x416fe0240FUNC<unknown>DEFAULT3
                initConnection.symtab0x409910708FUNC<unknown>DEFAULT3
                init_rand.symtab0x400ad4300FUNC<unknown>DEFAULT3
                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                initial_fa.symtab0x45d320264OBJECT<unknown>DEFAULT11
                initstate.symtab0x411d74208FUNC<unknown>DEFAULT3
                initstate_r.symtab0x412250328FUNC<unknown>DEFAULT3
                ioctl.symtab0x40df60104FUNC<unknown>DEFAULT3
                ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                isatty.symtab0x4105e060FUNC<unknown>DEFAULT3
                isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                kill.symtab0x40dfd088FUNC<unknown>DEFAULT3
                kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                killer_status.symtab0x45daf04OBJECT<unknown>DEFAULT14
                lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/mips/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/string/mips/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                libc/sysdeps/linux/mips/pipe.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                listFork.symtab0x403364632FUNC<unknown>DEFAULT3
                llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                lseek64.symtab0x418230164FUNC<unknown>DEFAULT3
                macAddress.symtab0x45daf46OBJECT<unknown>DEFAULT14
                main.symtab0x409f743460FUNC<unknown>DEFAULT3
                main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                makeIPPacket.symtab0x4039b8296FUNC<unknown>DEFAULT3
                makeRandomStr.symtab0x402bb0268FUNC<unknown>DEFAULT3
                makevsepacket.symtab0x4056f4332FUNC<unknown>DEFAULT3
                malloc.symtab0x4112a0492FUNC<unknown>DEFAULT3
                malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memchr.symtab0x414570264FUNC<unknown>DEFAULT3
                memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memcpy.symtab0x40fcf0308FUNC<unknown>DEFAULT3
                memmove.symtab0x414680816FUNC<unknown>DEFAULT3
                memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                mempcpy.symtab0x4149b076FUNC<unknown>DEFAULT3
                mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memrchr.symtab0x414a00272FUNC<unknown>DEFAULT3
                memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                memset.symtab0x40fe30144FUNC<unknown>DEFAULT3
                mylock.symtab0x45d44024OBJECT<unknown>DEFAULT11
                mylock.symtab0x463d7024OBJECT<unknown>DEFAULT14
                mylock.symtab0x45d56024OBJECT<unknown>DEFAULT11
                nanosleep.symtab0x41333084FUNC<unknown>DEFAULT3
                nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                next_start.1065.symtab0x463b204OBJECT<unknown>DEFAULT14
                ngPid.symtab0x45da9c4OBJECT<unknown>DEFAULT13
                ntohl.symtab0x4106d040FUNC<unknown>DEFAULT3
                ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ntohs.symtab0x4106f824FUNC<unknown>DEFAULT3
                ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                numpids.symtab0x45dae88OBJECT<unknown>DEFAULT14
                object.2349.symtab0x45dac424OBJECT<unknown>DEFAULT14
                open.symtab0x40e030124FUNC<unknown>DEFAULT3
                open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                ourIP.symtab0x45da984OBJECT<unknown>DEFAULT13
                p.2294.symtab0x45d0c00OBJECT<unknown>DEFAULT11
                parseHex.symtab0x40272c176FUNC<unknown>DEFAULT3
                pids.symtab0x45daa44OBJECT<unknown>DEFAULT13
                pipe.symtab0x40da8064FUNC<unknown>DEFAULT3
                poll.symtab0x415df084FUNC<unknown>DEFAULT3
                poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                prctl.symtab0x40e0d0120FUNC<unknown>DEFAULT3
                prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                prefix.4045.symtab0x41bed012OBJECT<unknown>DEFAULT5
                print.symtab0x4017201456FUNC<unknown>DEFAULT3
                printchar.symtab0x401194184FUNC<unknown>DEFAULT3
                printi.symtab0x401488664FUNC<unknown>DEFAULT3
                prints.symtab0x40124c572FUNC<unknown>DEFAULT3
                processCmd.symtab0x406bc411596FUNC<unknown>DEFAULT3
                qual_chars.4050.symtab0x41bef020OBJECT<unknown>DEFAULT5
                raise.symtab0x4181e076FUNC<unknown>DEFAULT3
                raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand.symtab0x411c0028FUNC<unknown>DEFAULT3
                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                rand__str.symtab0x40af1c372FUNC<unknown>DEFAULT3
                rand_alpha_str.symtab0x40b090300FUNC<unknown>DEFAULT3
                rand_alphastr.symtab0x400fc4464FUNC<unknown>DEFAULT3
                rand_cmwc.symtab0x400dec472FUNC<unknown>DEFAULT3
                rand_init.symtab0x40ad00248FUNC<unknown>DEFAULT3
                rand_next.symtab0x40adf8292FUNC<unknown>DEFAULT3
                random.symtab0x411c20164FUNC<unknown>DEFAULT3
                random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                random_poly_info.symtab0x41cb9040OBJECT<unknown>DEFAULT5
                random_r.symtab0x41202c176FUNC<unknown>DEFAULT3
                random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                randtbl.symtab0x45d458128OBJECT<unknown>DEFAULT11
                rawmemchr.symtab0x416d70200FUNC<unknown>DEFAULT3
                rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                read.symtab0x40e15084FUNC<unknown>DEFAULT3
                read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                realloc.symtab0x4116e0472FUNC<unknown>DEFAULT3
                realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recv.symtab0x410dc084FUNC<unknown>DEFAULT3
                recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                recvLine.symtab0x402cbc876FUNC<unknown>DEFAULT3
                recvfrom.symtab0x410e20128FUNC<unknown>DEFAULT3
                recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                resolv_domain_to_hostname.symtab0x40b1c0360FUNC<unknown>DEFAULT3
                resolv_entries_free.symtab0x40be44164FUNC<unknown>DEFAULT3
                resolv_lookup.symtab0x40b46c2520FUNC<unknown>DEFAULT3
                resolv_skip_name.symtab0x40b328324FUNC<unknown>DEFAULT3
                rtcp.symtab0x404d581740FUNC<unknown>DEFAULT3
                sbrk.symtab0x413390144FUNC<unknown>DEFAULT3
                sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                scanPid.symtab0x45daa04OBJECT<unknown>DEFAULT13
                select.symtab0x40e1b0120FUNC<unknown>DEFAULT3
                select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                send.symtab0x410ea084FUNC<unknown>DEFAULT3
                send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sendSTD.symtab0x405424720FUNC<unknown>DEFAULT3
                sendto.symtab0x410f00128FUNC<unknown>DEFAULT3
                sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setsockopt.symtab0x410f80120FUNC<unknown>DEFAULT3
                setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                setstate.symtab0x411cc4176FUNC<unknown>DEFAULT3
                setstate_r.symtab0x411ef0316FUNC<unknown>DEFAULT3
                sigaction.symtab0x413060232FUNC<unknown>DEFAULT3
                sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigaddset.symtab0x411060104FUNC<unknown>DEFAULT3
                sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigemptyset.symtab0x4110d060FUNC<unknown>DEFAULT3
                signal.symtab0x411110252FUNC<unknown>DEFAULT3
                signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigprocmask.symtab0x40e230148FUNC<unknown>DEFAULT3
                sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                sleep.symtab0x4127f0564FUNC<unknown>DEFAULT3
                sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket.symtab0x41100084FUNC<unknown>DEFAULT3
                socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                socket_connect.symtab0x406380444FUNC<unknown>DEFAULT3
                sockprintf.symtab0x401dc0344FUNC<unknown>DEFAULT3
                spec_and_mask.4049.symtab0x41bf0416OBJECT<unknown>DEFAULT5
                spec_base.4044.symtab0x41bedc7OBJECT<unknown>DEFAULT5
                spec_chars.4046.symtab0x41bf3021OBJECT<unknown>DEFAULT5
                spec_flags.4045.symtab0x41bf488OBJECT<unknown>DEFAULT5
                spec_or_mask.4048.symtab0x41bf1416OBJECT<unknown>DEFAULT5
                spec_ranges.4047.symtab0x41bf249OBJECT<unknown>DEFAULT5
                sprintf.symtab0x40e4a080FUNC<unknown>DEFAULT3
                sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                srand.symtab0x411e44172FUNC<unknown>DEFAULT3
                srandom.symtab0x411e44172FUNC<unknown>DEFAULT3
                srandom_r.symtab0x4120dc372FUNC<unknown>DEFAULT3
                static_id.symtab0x45d5302OBJECT<unknown>DEFAULT11
                static_ns.symtab0x463d884OBJECT<unknown>DEFAULT14
                stderr.symtab0x45d2184OBJECT<unknown>DEFAULT11
                stdin.symtab0x45d2104OBJECT<unknown>DEFAULT11
                stdout.symtab0x45d2144OBJECT<unknown>DEFAULT11
                strcasecmp.symtab0x4184b0108FUNC<unknown>DEFAULT3
                strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strchr.symtab0x40fec0256FUNC<unknown>DEFAULT3
                strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcmp.symtab0x40ffc044FUNC<unknown>DEFAULT3
                strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strcoll.symtab0x40ffc044FUNC<unknown>DEFAULT3
                strcpy.symtab0x40fff036FUNC<unknown>DEFAULT3
                strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strdup.symtab0x416f50144FUNC<unknown>DEFAULT3
                strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strerror_r.symtab0x4103f0392FUNC<unknown>DEFAULT3
                strlen.symtab0x410020184FUNC<unknown>DEFAULT3
                strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncat.symtab0x416e40180FUNC<unknown>DEFAULT3
                strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strncpy.symtab0x4100e0188FUNC<unknown>DEFAULT3
                strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strnlen.symtab0x4101a0256FUNC<unknown>DEFAULT3
                strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strpbrk.symtab0x414be064FUNC<unknown>DEFAULT3
                strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strspn.symtab0x416f0076FUNC<unknown>DEFAULT3
                strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strstr.symtab0x4102a0256FUNC<unknown>DEFAULT3
                strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok.symtab0x4105c032FUNC<unknown>DEFAULT3
                strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtok_r.symtab0x414b10204FUNC<unknown>DEFAULT3
                strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                strtol.symtab0x4123c028FUNC<unknown>DEFAULT3
                strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                szprintf.symtab0x401d48120FUNC<unknown>DEFAULT3
                table.symtab0x463db0232OBJECT<unknown>DEFAULT14
                table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                table_init.symtab0x40bef01068FUNC<unknown>DEFAULT3
                table_key.symtab0x45d1a04OBJECT<unknown>DEFAULT11
                table_lock_val.symtab0x40c3a0132FUNC<unknown>DEFAULT3
                table_retrieve_val.symtab0x40c424144FUNC<unknown>DEFAULT3
                table_unlock_val.symtab0x40c31c132FUNC<unknown>DEFAULT3
                tcgetattr.symtab0x410620176FUNC<unknown>DEFAULT3
                tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                tcpFl00d.symtab0x4044442324FUNC<unknown>DEFAULT3
                tcpcsum.symtab0x403854356FUNC<unknown>DEFAULT3
                time.symtab0x40e2d084FUNC<unknown>DEFAULT3
                time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                times.symtab0x41342084FUNC<unknown>DEFAULT3
                times.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                toggle_obf.symtab0x40c57c552FUNC<unknown>DEFAULT3
                tolower.symtab0x4182e060FUNC<unknown>DEFAULT3
                tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                toupper.symtab0x40e3d060FUNC<unknown>DEFAULT3
                toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                trim.symtab0x400c00492FUNC<unknown>DEFAULT3
                type_codes.symtab0x41bf5024OBJECT<unknown>DEFAULT5
                type_sizes.symtab0x41bf6812OBJECT<unknown>DEFAULT5
                udpfl00d.symtab0x403ae02404FUNC<unknown>DEFAULT3
                unknown.1088.symtab0x41c00014OBJECT<unknown>DEFAULT5
                unsafe_state.symtab0x45d4e028OBJECT<unknown>DEFAULT11
                uppercase.symtab0x402b0c164FUNC<unknown>DEFAULT3
                userID.symtab0x45d0f84OBJECT<unknown>DEFAULT11
                usleep.symtab0x412a30144FUNC<unknown>DEFAULT3
                usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                util.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                util_atoi.symtab0x40ccd4968FUNC<unknown>DEFAULT3
                util_fdgets.symtab0x40d75c320FUNC<unknown>DEFAULT3
                util_isalpha.symtab0x40d904144FUNC<unknown>DEFAULT3
                util_isdigit.symtab0x40da14104FUNC<unknown>DEFAULT3
                util_isspace.symtab0x40d994128FUNC<unknown>DEFAULT3
                util_isupper.symtab0x40d89c104FUNC<unknown>DEFAULT3
                util_itoa.symtab0x40d09c572FUNC<unknown>DEFAULT3
                util_local_addr.symtab0x40d608340FUNC<unknown>DEFAULT3
                util_memcpy.symtab0x40cbb8164FUNC<unknown>DEFAULT3
                util_memsearch.symtab0x40d2d8292FUNC<unknown>DEFAULT3
                util_strcat.symtab0x40cb10168FUNC<unknown>DEFAULT3
                util_strcmp.symtab0x40c964288FUNC<unknown>DEFAULT3
                util_strcpy.symtab0x40ca84140FUNC<unknown>DEFAULT3
                util_stristr.symtab0x40d3fc524FUNC<unknown>DEFAULT3
                util_strlen.symtab0x40c7b0116FUNC<unknown>DEFAULT3
                util_strncmp.symtab0x40c824320FUNC<unknown>DEFAULT3
                util_zero.symtab0x40cc5c120FUNC<unknown>DEFAULT3
                vfork.symtab0x40e33028FUNC<unknown>DEFAULT3
                vfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                vseattack.symtab0x4058402508FUNC<unknown>DEFAULT3
                vsnprintf.symtab0x40e4f0260FUNC<unknown>DEFAULT3
                vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                w.symtab0x461b0c4OBJECT<unknown>DEFAULT14
                wait4.symtab0x41348088FUNC<unknown>DEFAULT3
                wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                waitpid.symtab0x40e35028FUNC<unknown>DEFAULT3
                waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                watchdog_maintain.symtab0x4008a0564FUNC<unknown>DEFAULT3
                watchdog_pid.symtab0x45dae44OBJECT<unknown>DEFAULT14
                wcrtomb.symtab0x413500112FUNC<unknown>DEFAULT3
                wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsnrtombs.symtab0x4135b0228FUNC<unknown>DEFAULT3
                wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wcsrtombs.symtab0x41357064FUNC<unknown>DEFAULT3
                wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                wildString.symtab0x4027dc656FUNC<unknown>DEFAULT3
                write.symtab0x40e37084FUNC<unknown>DEFAULT3
                write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                x.symtab0x461b004OBJECT<unknown>DEFAULT14
                xdigits.3043.symtab0x41ccf417OBJECT<unknown>DEFAULT5
                y.symtab0x461b044OBJECT<unknown>DEFAULT14
                z.symtab0x461b084OBJECT<unknown>DEFAULT14
                zprintf.symtab0x401cd0120FUNC<unknown>DEFAULT3

                Download Network PCAP: filteredfull

                • Total Packets: 27
                • 820 undefined
                • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Mar 16, 2025 16:14:03.535073042 CET40406820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:03.539958954 CET82040406141.11.212.101192.168.2.14
                Mar 16, 2025 16:14:03.540023088 CET40406820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:03.558733940 CET40406820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:03.563545942 CET82040406141.11.212.101192.168.2.14
                Mar 16, 2025 16:14:24.908751965 CET82040406141.11.212.101192.168.2.14
                Mar 16, 2025 16:14:24.909141064 CET40406820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:24.909142017 CET40406820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:24.914855957 CET82040406141.11.212.101192.168.2.14
                Mar 16, 2025 16:14:39.913270950 CET40408820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:39.918447971 CET82040408141.11.212.101192.168.2.14
                Mar 16, 2025 16:14:39.918864965 CET40408820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:39.918917894 CET40408820192.168.2.14141.11.212.101
                Mar 16, 2025 16:14:39.923616886 CET82040408141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:01.271430969 CET82040408141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:01.271694899 CET40408820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:01.276456118 CET82040408141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:16.275227070 CET40410820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:16.280030012 CET82040410141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:16.280086040 CET40410820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:16.280121088 CET40410820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:16.284774065 CET82040410141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:37.665724993 CET82040410141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:37.666049004 CET40410820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:37.670723915 CET82040410141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:52.670929909 CET40412820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:52.675689936 CET82040412141.11.212.101192.168.2.14
                Mar 16, 2025 16:15:52.675770998 CET40412820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:52.675868034 CET40412820192.168.2.14141.11.212.101
                Mar 16, 2025 16:15:52.680516958 CET82040412141.11.212.101192.168.2.14
                Mar 16, 2025 16:16:14.055550098 CET82040412141.11.212.101192.168.2.14
                Mar 16, 2025 16:16:14.055705070 CET40412820192.168.2.14141.11.212.101
                Mar 16, 2025 16:16:14.060389996 CET82040412141.11.212.101192.168.2.14
                Mar 16, 2025 16:16:29.059536934 CET40414820192.168.2.14141.11.212.101
                Mar 16, 2025 16:16:29.064327002 CET82040414141.11.212.101192.168.2.14
                Mar 16, 2025 16:16:29.064380884 CET40414820192.168.2.14141.11.212.101
                Mar 16, 2025 16:16:29.064398050 CET40414820192.168.2.14141.11.212.101
                Mar 16, 2025 16:16:29.069025993 CET82040414141.11.212.101192.168.2.14
                Mar 16, 2025 16:16:50.444226027 CET82040414141.11.212.101192.168.2.14
                Mar 16, 2025 16:16:50.444312096 CET40414820192.168.2.14141.11.212.101
                Mar 16, 2025 16:16:50.449059010 CET82040414141.11.212.101192.168.2.14
                Mar 16, 2025 16:17:05.447510958 CET40416820192.168.2.14141.11.212.101
                Mar 16, 2025 16:17:05.452285051 CET82040416141.11.212.101192.168.2.14
                Mar 16, 2025 16:17:05.452323914 CET40416820192.168.2.14141.11.212.101
                Mar 16, 2025 16:17:05.452351093 CET40416820192.168.2.14141.11.212.101
                Mar 16, 2025 16:17:05.456995010 CET82040416141.11.212.101192.168.2.14
                Mar 16, 2025 16:17:26.838011980 CET82040416141.11.212.101192.168.2.14
                Mar 16, 2025 16:17:26.838993073 CET40416820192.168.2.14141.11.212.101
                Mar 16, 2025 16:17:26.844711065 CET82040416141.11.212.101192.168.2.14
                TimestampSource PortDest PortSource IPDest IP
                Mar 16, 2025 16:16:49.839495897 CET4247453192.168.2.141.1.1.1
                Mar 16, 2025 16:16:49.839543104 CET6044553192.168.2.141.1.1.1
                Mar 16, 2025 16:16:49.846380949 CET53604451.1.1.1192.168.2.14
                Mar 16, 2025 16:16:49.847341061 CET53424741.1.1.1192.168.2.14
                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Mar 16, 2025 16:16:49.839495897 CET192.168.2.141.1.1.10x595dStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Mar 16, 2025 16:16:49.839543104 CET192.168.2.141.1.1.10xbe01Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Mar 16, 2025 16:16:49.847341061 CET1.1.1.1192.168.2.140x595dNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                Mar 16, 2025 16:16:49.847341061 CET1.1.1.1192.168.2.140x595dNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                System Behavior

                Start time (UTC):15:14:02
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
                Arguments:/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
                File size:5773336 bytes
                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                Start time (UTC):15:14:02
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
                Arguments:-
                File size:5773336 bytes
                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                Start time (UTC):15:14:02
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
                Arguments:-
                File size:5773336 bytes
                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                Start time (UTC):15:14:02
                Start date (UTC):16/03/2025
                Path:/tmp/141.11.212.101-mipsel-2025-03-03T07_22_23.elf
                Arguments:-
                File size:5773336 bytes
                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9