Edit tour

Linux Analysis Report
hidakibest.mpsl.elf

Overview

General Information

Sample name:hidakibest.mpsl.elf
Analysis ID:1649679
MD5:12c3eb087a8e4d16a9da8d5c288ded43
SHA1:e663b680cbd3f3d366f3860b3dd71350d1f4096c
SHA256:692a564ef61e6fa9def7997804d4c3c66d3d88e16516d28aa27f1be947c7d854
Tags:elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score:92
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1649679
Start date and time:2025-03-27 01:17:13 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 20s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:hidakibest.mpsl.elf
Detection:MAL
Classification:mal92.spre.troj.linELF@0/0@2/0
  • VT rate limit hit for: 213.152.43.231:4258
Command:/tmp/hidakibest.mpsl.elf
PID:5477
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
hidakibest.mpsl.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    hidakibest.mpsl.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      hidakibest.mpsl.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x16e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16e60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16e74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16e88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16e9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16eb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      hidakibest.mpsl.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0x16de8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      SourceRuleDescriptionAuthorStrings
      5477.1.00007fd560400000.00007fd56041a000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
        5477.1.00007fd560400000.00007fd56041a000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5477.1.00007fd560400000.00007fd56041a000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x16e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16e60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16e74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16e88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16e9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16eb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x16fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          5477.1.00007fd560400000.00007fd56041a000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
          • 0x16de8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
          5479.1.00007fd560400000.00007fd56041a000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
            Click to see the 9 entries
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: hidakibest.mpsl.elfAvira: detected
            Source: hidakibest.mpsl.elfMalware Configuration Extractor: Gafgyt {"C2 url": "213.152.43.231:4258"}
            Source: hidakibest.mpsl.elfVirustotal: Detection: 67%Perma Link
            Source: hidakibest.mpsl.elfReversingLabs: Detection: 61%

            Spreading

            barindex
            Source: /tmp/hidakibest.mpsl.elf (PID: 5477)Opens: /proc/net/routeJump to behavior
            Source: global trafficTCP traffic: 192.168.2.13:48708 -> 213.152.43.231:4258
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: unknownTCP traffic detected without corresponding DNS query: 213.152.43.231
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
            Source: hidakibest.mpsl.elfString found in binary or memory: http://fast.no/support/crawler.asp)
            Source: hidakibest.mpsl.elfString found in binary or memory: http://feedback.redkolibri.com/
            Source: hidakibest.mpsl.elfString found in binary or memory: http://www.baidu.com/search/spider.htm)
            Source: hidakibest.mpsl.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
            Source: hidakibest.mpsl.elfString found in binary or memory: http://www.billybobbot.com/crawler/)

            System Summary

            barindex
            Source: hidakibest.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: hidakibest.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5477, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5477, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5479, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5479, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: hidakibest.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: hidakibest.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5477, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5477, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5479, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: hidakibest.mpsl.elf PID: 5479, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: classification engineClassification label: mal92.spre.troj.linELF@0/0@2/0
            Source: /tmp/hidakibest.mpsl.elf (PID: 5477)Queries kernel information via 'uname': Jump to behavior
            Source: hidakibest.mpsl.elf, 5477.1.000055db96a02000.000055db96a89000.rw-.sdmp, hidakibest.mpsl.elf, 5479.1.000055db96a02000.000055db96a89000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
            Source: hidakibest.mpsl.elf, 5477.1.00007ffe31250000.00007ffe31271000.rw-.sdmp, hidakibest.mpsl.elf, 5479.1.00007ffe31250000.00007ffe31271000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/hidakibest.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hidakibest.mpsl.elf
            Source: hidakibest.mpsl.elf, 5477.1.000055db96a02000.000055db96a89000.rw-.sdmp, hidakibest.mpsl.elf, 5479.1.000055db96a02000.000055db96a89000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
            Source: hidakibest.mpsl.elf, 5477.1.00007ffe31250000.00007ffe31271000.rw-.sdmp, hidakibest.mpsl.elf, 5479.1.00007ffe31250000.00007ffe31271000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: hidakibest.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: hidakibest.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: hidakibest.mpsl.elf PID: 5477, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: hidakibest.mpsl.elf PID: 5479, type: MEMORYSTR
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
            Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
            Source: Initial sampleUser agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: hidakibest.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: hidakibest.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: 5477.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5479.1.00007fd560400000.00007fd56041a000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: hidakibest.mpsl.elf PID: 5477, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: hidakibest.mpsl.elf PID: 5479, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Data Obfuscation
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
            Remote System Discovery
            Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
            Application Layer Protocol
            Traffic DuplicationData Destruction
            {
              "C2 url": "213.152.43.231:4258"
            }
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1649679 Sample: hidakibest.mpsl.elf Startdate: 27/03/2025 Architecture: LINUX Score: 92 15 213.152.43.231, 4258, 48708, 48710 ECLIPSEGB United Kingdom 2->15 17 daisy.ubuntu.com 2->17 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 3 other signatures 2->25 8 hidakibest.mpsl.elf 2->8         started        signatures3 process4 signatures5 27 Opens /proc/net/* files useful for finding connected devices and routers 8->27 11 hidakibest.mpsl.elf 8->11         started        process6 process7 13 hidakibest.mpsl.elf 11->13         started       

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            hidakibest.mpsl.elf67%VirustotalBrowse
            hidakibest.mpsl.elf61%ReversingLabsLinux.Trojan.LnxGafgyt
            hidakibest.mpsl.elf100%AviraEXP/ELF.Mirai.Z.A
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            162.213.35.25
            truefalse
              high
              NameMaliciousAntivirus DetectionReputation
              213.152.43.231:4258true
                unknown
                NameSourceMaliciousAntivirus DetectionReputation
                http://www.baidu.com/search/spider.html)hidakibest.mpsl.elffalse
                  high
                  http://www.billybobbot.com/crawler/)hidakibest.mpsl.elffalse
                    high
                    http://fast.no/support/crawler.asp)hidakibest.mpsl.elffalse
                      high
                      http://feedback.redkolibri.com/hidakibest.mpsl.elffalse
                        high
                        http://www.baidu.com/search/spider.htm)hidakibest.mpsl.elffalse
                          high
                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs
                          IPDomainCountryFlagASNASN NameMalicious
                          213.152.43.231
                          unknownUnited Kingdom
                          12513ECLIPSEGBtrue
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          213.152.43.231hidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                            hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                              hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  daisy.ubuntu.comhidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.24
                                  weje64.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  resgod.mpsl.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.24
                                  hanoi.i686.elfGet hashmaliciousUnknownBrowse
                                  • 162.213.35.25
                                  resgod.mips.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.24
                                  hanoi.x86.elfGet hashmaliciousUnknownBrowse
                                  • 162.213.35.25
                                  hanoi.arm.elfGet hashmaliciousUnknownBrowse
                                  • 162.213.35.25
                                  hanoi.sh4.elfGet hashmaliciousMirai, Okiru, XmrigBrowse
                                  • 162.213.35.25
                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  ECLIPSEGBhidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 213.152.43.231
                                  hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 213.152.43.231
                                  hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 213.152.43.231
                                  hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 213.152.43.231
                                  file.exeGet hashmaliciousAsyncRATBrowse
                                  • 109.176.30.246
                                  file.exeGet hashmaliciousAsyncRATBrowse
                                  • 109.176.30.246
                                  file.exeGet hashmaliciousAsyncRATBrowse
                                  • 109.176.30.246
                                  file.exeGet hashmaliciousAsyncRATBrowse
                                  • 109.176.30.246
                                  InstaIIer.exeGet hashmaliciousRHADAMANTHYSBrowse
                                  • 91.84.105.30
                                  InstaIIer_patched.exeGet hashmaliciousRHADAMANTHYSBrowse
                                  • 91.84.105.30
                                  No context
                                  No context
                                  No created / dropped files found
                                  File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                                  Entropy (8bit):5.40916366675586
                                  TrID:
                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                  File name:hidakibest.mpsl.elf
                                  File size:144'442 bytes
                                  MD5:12c3eb087a8e4d16a9da8d5c288ded43
                                  SHA1:e663b680cbd3f3d366f3860b3dd71350d1f4096c
                                  SHA256:692a564ef61e6fa9def7997804d4c3c66d3d88e16516d28aa27f1be947c7d854
                                  SHA512:f201847ac01a6d37f979db03d354f9ed58e350096f3f6e9b844d49e377fea2d3a3c2b5a1e68d8e0d2cf657f220041e037e679d705fbf430b070bebbcd7ea1381
                                  SSDEEP:3072:lBXpqf9VHGn7vsT5htpRvHpVFm0/5ApYADn:llp4WvsT5htvp7m0/5ASADn
                                  TLSH:F6E3F907EB614DB7C84FCE3202D68525148EA5A653D56FABB278CB5CFB0798B49E3C40
                                  File Content Preview:.ELF......................@.4...........4. ...(........p......@...@...........................@...@...........................B...B.....x...............D...D.B.D.B.................Q.td.................................................(C....<.(.'!......'...

                                  ELF header

                                  Class:ELF32
                                  Data:2's complement, little endian
                                  Version:1 (current)
                                  Machine:MIPS R3000
                                  Version Number:0x1
                                  Type:EXEC (Executable file)
                                  OS/ABI:UNIX - System V
                                  ABI Version:0
                                  Entry Point Address:0x4002d0
                                  Flags:0x1007
                                  ELF Header Size:52
                                  Program Header Offset:52
                                  Program Header Size:32
                                  Number of Program Headers:5
                                  Section Header Offset:121096
                                  Section Header Size:40
                                  Number of Section Headers:23
                                  Header String Table Index:20
                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                  NULL0x00x00x00x00x0000
                                  .reginfoMIPS_REGINFO0x4000d40xd40x180x180x2A004
                                  .initPROGBITS0x4000ec0xec0x8c0x00x6AX004
                                  .textPROGBITS0x4001800x1800x150500x00x6AX0016
                                  .finiPROGBITS0x4151d00x151d00x5c0x00x6AX004
                                  .rodataPROGBITS0x4152300x152300x3fc00x00x2A0016
                                  .eh_framePROGBITS0x42a0000x1a0000x440x00x3WA004
                                  .tbssNOBITS0x42a0440x1a0440x80x00x403WAT004
                                  .ctorsPROGBITS0x42a0440x1a0440x80x00x3WA004
                                  .dtorsPROGBITS0x42a04c0x1a04c0x80x00x3WA004
                                  .jcrPROGBITS0x42a0540x1a0540x40x00x3WA004
                                  .data.rel.roPROGBITS0x42a0580x1a0580x4d00x00x3WA004
                                  .dataPROGBITS0x42a5300x1a5300x3d00x00x3WA0016
                                  .gotPROGBITS0x42a9000x1a9000x4e00x40x10000003WAp0016
                                  .sdataPROGBITS0x42ade00x1ade00x40x00x10000003WAp004
                                  .sbssNOBITS0x42ade40x1ade40x4c0x00x10000003WAp004
                                  .bssNOBITS0x42ae300x1ade40x71480x00x3WA0016
                                  .commentPROGBITS0x00x1ade40xb9a0x00x0001
                                  .mdebug.abi32PROGBITS0xb9a0x1b97e0x00x00x0001
                                  .pdrPROGBITS0x00x1b9800x1ee00x00x0004
                                  .shstrtabSTRTAB0x00x1d8600xa70x00x0001
                                  .symtabSYMTAB0x00x1dca00x31800x100x0223224
                                  .strtabSTRTAB0x00x20e200x261a0x00x0001
                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                  <unknown>0xd40x4000d40x4000d40x180x180.98340x4R 0x4.reginfo
                                  LOAD0x00x4000000x4000000x191f00x191f05.54450x5R E0x10000.reginfo .init .text .fini .rodata
                                  LOAD0x1a0000x42a0000x42a0000xde40x7f784.78140x6RW 0x10000.eh_frame .tbss .ctors .dtors .jcr .data.rel.ro .data .got .sdata .sbss .bss
                                  TLS0x1a0440x42a0440x42a0440x00x80.00000x4R 0x4.tbss
                                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                  NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                  .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                  .symtab0x4000d40SECTION<unknown>DEFAULT1
                                  .symtab0x4000ec0SECTION<unknown>DEFAULT2
                                  .symtab0x4001800SECTION<unknown>DEFAULT3
                                  .symtab0x4151d00SECTION<unknown>DEFAULT4
                                  .symtab0x4152300SECTION<unknown>DEFAULT5
                                  .symtab0x42a0000SECTION<unknown>DEFAULT6
                                  .symtab0x42a0440SECTION<unknown>DEFAULT7
                                  .symtab0x42a0440SECTION<unknown>DEFAULT8
                                  .symtab0x42a04c0SECTION<unknown>DEFAULT9
                                  .symtab0x42a0540SECTION<unknown>DEFAULT10
                                  .symtab0x42a0580SECTION<unknown>DEFAULT11
                                  .symtab0x42a5300SECTION<unknown>DEFAULT12
                                  .symtab0x42a9000SECTION<unknown>DEFAULT13
                                  .symtab0x42ade00SECTION<unknown>DEFAULT14
                                  .symtab0x42ade40SECTION<unknown>DEFAULT15
                                  .symtab0x42ae300SECTION<unknown>DEFAULT16
                                  .symtab0x00SECTION<unknown>DEFAULT17
                                  .symtab0xb9a0SECTION<unknown>DEFAULT18
                                  .symtab0x00SECTION<unknown>DEFAULT19
                                  C.1.5091.symtab0x41903024OBJECT<unknown>DEFAULT5
                                  C.3.5380.symtab0x418d0c12OBJECT<unknown>DEFAULT5
                                  C.3.6092.symtab0x417bd012OBJECT<unknown>DEFAULT5
                                  C.3.6114.symtab0x41907812OBJECT<unknown>DEFAULT5
                                  C.3.6172.symtab0x41905012OBJECT<unknown>DEFAULT5
                                  C.4.6115.symtab0x41906c12OBJECT<unknown>DEFAULT5
                                  C.5.6123.symtab0x41906012OBJECT<unknown>DEFAULT5
                                  C.6.5518.symtab0x418d0012OBJECT<unknown>DEFAULT5
                                  C.70.5296.symtab0x42a058104OBJECT<unknown>DEFAULT11
                                  C.77.5395.symtab0x42a0c01128OBJECT<unknown>DEFAULT11
                                  FRAMESZ.symtab0x200NOTYPE<unknown>DEFAULTSHN_ABS
                                  GPOFF.symtab0x180NOTYPE<unknown>DEFAULTSHN_ABS
                                  LOCALSZ.symtab0x30NOTYPE<unknown>DEFAULTSHN_ABS
                                  Q.symtab0x42ae6816384OBJECT<unknown>DEFAULT16
                                  RAOFF.symtab0x1c0NOTYPE<unknown>DEFAULTSHN_ABS
                                  Randhex.symtab0x402c80696FUNC<unknown>DEFAULT3
                                  SendSTD.symtab0x4025a0688FUNC<unknown>DEFAULT3
                                  UDPRAW.symtab0x402a68536FUNC<unknown>DEFAULT3
                                  V0OFF.symtab0x140NOTYPE<unknown>DEFAULTSHN_ABS
                                  _Exit.symtab0x40629076FUNC<unknown>DEFAULT3
                                  _GLOBAL_OFFSET_TABLE_.symtab0x42a9000OBJECT<unknown>DEFAULT13
                                  _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                  _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __CTOR_END__.symtab0x42a0480OBJECT<unknown>DEFAULT8
                                  __CTOR_LIST__.symtab0x42a0440OBJECT<unknown>DEFAULT8
                                  __C_ctype_b.symtab0x42a6604OBJECT<unknown>DEFAULT12
                                  __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __C_ctype_b_data.symtab0x4175d0768OBJECT<unknown>DEFAULT5
                                  __C_ctype_tolower.symtab0x42a7c04OBJECT<unknown>DEFAULT12
                                  __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __C_ctype_tolower_data.symtab0x418d30768OBJECT<unknown>DEFAULT5
                                  __C_ctype_toupper.symtab0x42a6704OBJECT<unknown>DEFAULT12
                                  __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __C_ctype_toupper_data.symtab0x4178d0768OBJECT<unknown>DEFAULT5
                                  __DTOR_END__.symtab0x42a0500OBJECT<unknown>DEFAULT9
                                  __DTOR_LIST__.symtab0x42a04c0OBJECT<unknown>DEFAULT9
                                  __EH_FRAME_BEGIN__.symtab0x42a0000OBJECT<unknown>DEFAULT6
                                  __FRAME_END__.symtab0x42a0400OBJECT<unknown>DEFAULT6
                                  __GI___C_ctype_b.symtab0x42a6604OBJECT<unknown>HIDDEN12
                                  __GI___C_ctype_tolower.symtab0x42a7c04OBJECT<unknown>HIDDEN12
                                  __GI___C_ctype_toupper.symtab0x42a6704OBJECT<unknown>HIDDEN12
                                  __GI___close.symtab0x40bc1c176FUNC<unknown>HIDDEN3
                                  __GI___close_nocancel.symtab0x40bbf440FUNC<unknown>HIDDEN3
                                  __GI___ctype_b.symtab0x42a6644OBJECT<unknown>HIDDEN12
                                  __GI___ctype_tolower.symtab0x42a7c44OBJECT<unknown>HIDDEN12
                                  __GI___ctype_toupper.symtab0x42a6744OBJECT<unknown>HIDDEN12
                                  __GI___errno_location.symtab0x40669028FUNC<unknown>HIDDEN3
                                  __GI___fcntl_nocancel.symtab0x406110108FUNC<unknown>HIDDEN3
                                  __GI___fgetc_unlocked.symtab0x40fbb0388FUNC<unknown>HIDDEN3
                                  __GI___glibc_strerror_r.symtab0x40844068FUNC<unknown>HIDDEN3
                                  __GI___libc_close.symtab0x40bc1c176FUNC<unknown>HIDDEN3
                                  __GI___libc_fcntl.symtab0x40617c268FUNC<unknown>HIDDEN3
                                  __GI___libc_open.symtab0x40bd0c192FUNC<unknown>HIDDEN3
                                  __GI___libc_read.symtab0x40bf0c192FUNC<unknown>HIDDEN3
                                  __GI___libc_waitpid.symtab0x40c00c192FUNC<unknown>HIDDEN3
                                  __GI___libc_write.symtab0x40be0c192FUNC<unknown>HIDDEN3
                                  __GI___open.symtab0x40bd0c192FUNC<unknown>HIDDEN3
                                  __GI___open_nocancel.symtab0x40bce440FUNC<unknown>HIDDEN3
                                  __GI___read.symtab0x40bf0c192FUNC<unknown>HIDDEN3
                                  __GI___read_nocancel.symtab0x40bee440FUNC<unknown>HIDDEN3
                                  __GI___register_atfork.symtab0x40b680452FUNC<unknown>HIDDEN3
                                  __GI___sigaddset.symtab0x408f0844FUNC<unknown>HIDDEN3
                                  __GI___sigdelset.symtab0x408f3448FUNC<unknown>HIDDEN3
                                  __GI___sigismember.symtab0x408ee040FUNC<unknown>HIDDEN3
                                  __GI___uClibc_fini.symtab0x40c280204FUNC<unknown>HIDDEN3
                                  __GI___uClibc_init.symtab0x40c3d4120FUNC<unknown>HIDDEN3
                                  __GI___waitpid.symtab0x40c00c192FUNC<unknown>HIDDEN3
                                  __GI___write.symtab0x40be0c192FUNC<unknown>HIDDEN3
                                  __GI___write_nocancel.symtab0x40bde440FUNC<unknown>HIDDEN3
                                  __GI___xpg_strerror_r.symtab0x408490380FUNC<unknown>HIDDEN3
                                  __GI__exit.symtab0x40629076FUNC<unknown>HIDDEN3
                                  __GI_abort.symtab0x40a0f0408FUNC<unknown>HIDDEN3
                                  __GI_atoi.symtab0x40aa1028FUNC<unknown>HIDDEN3
                                  __GI_brk.symtab0x41175080FUNC<unknown>HIDDEN3
                                  __GI_chdir.symtab0x4062e056FUNC<unknown>HIDDEN3
                                  __GI_close.symtab0x40bc1c176FUNC<unknown>HIDDEN3
                                  __GI_closedir.symtab0x40cdf0292FUNC<unknown>HIDDEN3
                                  __GI_config_close.symtab0x40d7e4132FUNC<unknown>HIDDEN3
                                  __GI_config_open.symtab0x40d868116FUNC<unknown>HIDDEN3
                                  __GI_config_read.symtab0x40d3201220FUNC<unknown>HIDDEN3
                                  __GI_connect.symtab0x40896c220FUNC<unknown>HIDDEN3
                                  __GI_exit.symtab0x40ac40240FUNC<unknown>HIDDEN3
                                  __GI_fclose.symtab0x40da50804FUNC<unknown>HIDDEN3
                                  __GI_fcntl.symtab0x40617c268FUNC<unknown>HIDDEN3
                                  __GI_fflush_unlocked.symtab0x40f7f8940FUNC<unknown>HIDDEN3
                                  __GI_fgetc.symtab0x40f2b0372FUNC<unknown>HIDDEN3
                                  __GI_fgetc_unlocked.symtab0x40fbb0388FUNC<unknown>HIDDEN3
                                  __GI_fgets.symtab0x40f430320FUNC<unknown>HIDDEN3
                                  __GI_fgets_unlocked.symtab0x40fd40276FUNC<unknown>HIDDEN3
                                  __GI_fopen.symtab0x40dd8028FUNC<unknown>HIDDEN3
                                  __GI_fork.symtab0x40b250988FUNC<unknown>HIDDEN3
                                  __GI_fputs_unlocked.symtab0x407cc0124FUNC<unknown>HIDDEN3
                                  __GI_fseek.symtab0x411cb068FUNC<unknown>HIDDEN3
                                  __GI_fseeko64.symtab0x411d00500FUNC<unknown>HIDDEN3
                                  __GI_fstat.symtab0x411820136FUNC<unknown>HIDDEN3
                                  __GI_fwrite_unlocked.symtab0x407d40268FUNC<unknown>HIDDEN3
                                  __GI_getc_unlocked.symtab0x40fbb0388FUNC<unknown>HIDDEN3
                                  __GI_getdtablesize.symtab0x40ca4072FUNC<unknown>HIDDEN3
                                  __GI_getegid.symtab0x40ca9016FUNC<unknown>HIDDEN3
                                  __GI_geteuid.symtab0x40caa016FUNC<unknown>HIDDEN3
                                  __GI_getgid.symtab0x40cab016FUNC<unknown>HIDDEN3
                                  __GI_gethostbyname.symtab0x4088a028FUNC<unknown>HIDDEN3
                                  __GI_gethostbyname2.symtab0x4088c0104FUNC<unknown>HIDDEN3
                                  __GI_gethostbyname2_r.symtab0x410960948FUNC<unknown>HIDDEN3
                                  __GI_gethostbyname_r.symtab0x414270968FUNC<unknown>HIDDEN3
                                  __GI_gethostname.symtab0x4146a0192FUNC<unknown>HIDDEN3
                                  __GI_getpagesize.symtab0x40cac048FUNC<unknown>HIDDEN3
                                  __GI_getpid.symtab0x40b85084FUNC<unknown>HIDDEN3
                                  __GI_getrlimit.symtab0x40caf060FUNC<unknown>HIDDEN3
                                  __GI_getsockname.symtab0x408a5060FUNC<unknown>HIDDEN3
                                  __GI_getuid.symtab0x40cb3016FUNC<unknown>HIDDEN3
                                  __GI_htonl.symtab0x4086f840FUNC<unknown>HIDDEN3
                                  __GI_htons.symtab0x4086e024FUNC<unknown>HIDDEN3
                                  __GI_inet_addr.symtab0x40885072FUNC<unknown>HIDDEN3
                                  __GI_inet_aton.symtab0x410840284FUNC<unknown>HIDDEN3
                                  __GI_inet_ntoa.symtab0x40882c32FUNC<unknown>HIDDEN3
                                  __GI_inet_ntoa_r.symtab0x408760204FUNC<unknown>HIDDEN3
                                  __GI_inet_ntop.symtab0x412acc852FUNC<unknown>HIDDEN3
                                  __GI_inet_pton.symtab0x412658696FUNC<unknown>HIDDEN3
                                  __GI_initstate_r.symtab0x40a7cc300FUNC<unknown>HIDDEN3
                                  __GI_ioctl.symtab0x406320248FUNC<unknown>HIDDEN3
                                  __GI_isatty.symtab0x41075060FUNC<unknown>HIDDEN3
                                  __GI_isspace.symtab0x40662044FUNC<unknown>HIDDEN3
                                  __GI_kill.symtab0x40642056FUNC<unknown>HIDDEN3
                                  __GI_lseek64.symtab0x414950136FUNC<unknown>HIDDEN3
                                  __GI_memchr.symtab0x40fe60260FUNC<unknown>HIDDEN3
                                  __GI_memcpy.symtab0x407e50308FUNC<unknown>HIDDEN3
                                  __GI_memmove.symtab0x40ff70824FUNC<unknown>HIDDEN3
                                  __GI_mempcpy.symtab0x4123a076FUNC<unknown>HIDDEN3
                                  __GI_memrchr.symtab0x4102b0260FUNC<unknown>HIDDEN3
                                  __GI_memset.symtab0x407f90144FUNC<unknown>HIDDEN3
                                  __GI_mmap.symtab0x40c8c0112FUNC<unknown>HIDDEN3
                                  __GI_mremap.symtab0x4118b096FUNC<unknown>HIDDEN3
                                  __GI_munmap.symtab0x40cb4060FUNC<unknown>HIDDEN3
                                  __GI_nanosleep.symtab0x40cbbc200FUNC<unknown>HIDDEN3
                                  __GI_ntohl.symtab0x40873840FUNC<unknown>HIDDEN3
                                  __GI_ntohs.symtab0x40872024FUNC<unknown>HIDDEN3
                                  __GI_open.symtab0x40bd0c192FUNC<unknown>HIDDEN3
                                  __GI_opendir.symtab0x40d034240FUNC<unknown>HIDDEN3
                                  __GI_poll.symtab0x41479c220FUNC<unknown>HIDDEN3
                                  __GI_raise.symtab0x40b8b0264FUNC<unknown>HIDDEN3
                                  __GI_random.symtab0x40a2b0164FUNC<unknown>HIDDEN3
                                  __GI_random_r.symtab0x40a590172FUNC<unknown>HIDDEN3
                                  __GI_rawmemchr.symtab0x4123f0192FUNC<unknown>HIDDEN3
                                  __GI_read.symtab0x40bf0c192FUNC<unknown>HIDDEN3
                                  __GI_readdir64.symtab0x40d210272FUNC<unknown>HIDDEN3
                                  __GI_recv.symtab0x408b2c240FUNC<unknown>HIDDEN3
                                  __GI_sbrk.symtab0x40cc90164FUNC<unknown>HIDDEN3
                                  __GI_select.symtab0x4064c0260FUNC<unknown>HIDDEN3
                                  __GI_send.symtab0x408c5c240FUNC<unknown>HIDDEN3
                                  __GI_setsid.symtab0x4065d060FUNC<unknown>HIDDEN3
                                  __GI_setsockopt.symtab0x408d5096FUNC<unknown>HIDDEN3
                                  __GI_setstate_r.symtab0x40a8f8272FUNC<unknown>HIDDEN3
                                  __GI_sigaction.symtab0x40c93028FUNC<unknown>HIDDEN3
                                  __GI_signal.symtab0x408df0228FUNC<unknown>HIDDEN3
                                  __GI_sigprocmask.symtab0x40cd40176FUNC<unknown>HIDDEN3
                                  __GI_sleep.symtab0x40b9c0404FUNC<unknown>HIDDEN3
                                  __GI_socket.symtab0x408db060FUNC<unknown>HIDDEN3
                                  __GI_sprintf.symtab0x4066b080FUNC<unknown>HIDDEN3
                                  __GI_srandom_r.symtab0x40a63c400FUNC<unknown>HIDDEN3
                                  __GI_stat.symtab0x414880136FUNC<unknown>HIDDEN3
                                  __GI_strcasecmp.symtab0x408650108FUNC<unknown>HIDDEN3
                                  __GI_strchr.symtab0x408020248FUNC<unknown>HIDDEN3
                                  __GI_strchrnul.symtab0x4103c0248FUNC<unknown>HIDDEN3
                                  __GI_strcmp.symtab0x40812044FUNC<unknown>HIDDEN3
                                  __GI_strcoll.symtab0x40812044FUNC<unknown>HIDDEN3
                                  __GI_strcpy.symtab0x40815036FUNC<unknown>HIDDEN3
                                  __GI_strcspn.symtab0x4104c0144FUNC<unknown>HIDDEN3
                                  __GI_strdup.symtab0x4149e0140FUNC<unknown>HIDDEN3
                                  __GI_strlen.symtab0x408180184FUNC<unknown>HIDDEN3
                                  __GI_strncpy.symtab0x4124b0188FUNC<unknown>HIDDEN3
                                  __GI_strnlen.symtab0x408240248FUNC<unknown>HIDDEN3
                                  __GI_strpbrk.symtab0x41071064FUNC<unknown>HIDDEN3
                                  __GI_strrchr.symtab0x410550160FUNC<unknown>HIDDEN3
                                  __GI_strspn.symtab0x4105f072FUNC<unknown>HIDDEN3
                                  __GI_strstr.symtab0x408340256FUNC<unknown>HIDDEN3
                                  __GI_strtok.symtab0x4086c032FUNC<unknown>HIDDEN3
                                  __GI_strtok_r.symtab0x410640208FUNC<unknown>HIDDEN3
                                  __GI_strtol.symtab0x40aa3028FUNC<unknown>HIDDEN3
                                  __GI_sysconf.symtab0x40af2c792FUNC<unknown>HIDDEN3
                                  __GI_tcgetattr.symtab0x410790176FUNC<unknown>HIDDEN3
                                  __GI_time.symtab0x40661016FUNC<unknown>HIDDEN3
                                  __GI_toupper.symtab0x40665060FUNC<unknown>HIDDEN3
                                  __GI_uname.symtab0x41491060FUNC<unknown>HIDDEN3
                                  __GI_vsnprintf.symtab0x406700248FUNC<unknown>HIDDEN3
                                  __GI_waitpid.symtab0x40c00c192FUNC<unknown>HIDDEN3
                                  __GI_wcrtomb.symtab0x40d8e0108FUNC<unknown>HIDDEN3
                                  __GI_wcsnrtombs.symtab0x40d990192FUNC<unknown>HIDDEN3
                                  __GI_wcsrtombs.symtab0x40d95064FUNC<unknown>HIDDEN3
                                  __GI_write.symtab0x40be0c192FUNC<unknown>HIDDEN3
                                  __JCR_END__.symtab0x42a0540OBJECT<unknown>DEFAULT10
                                  __JCR_LIST__.symtab0x42a0540OBJECT<unknown>DEFAULT10
                                  __app_fini.symtab0x42f5ec4OBJECT<unknown>HIDDEN16
                                  __atexit_lock.symtab0x42a79024OBJECT<unknown>DEFAULT12
                                  __bss_start.symtab0x42ade40NOTYPE<unknown>DEFAULTSHN_ABS
                                  __check_one_fd.symtab0x40c34c136FUNC<unknown>DEFAULT3
                                  __close.symtab0x40bc1c176FUNC<unknown>DEFAULT3
                                  __close_nameservers.symtab0x414120220FUNC<unknown>HIDDEN3
                                  __close_nocancel.symtab0x40bbf440FUNC<unknown>DEFAULT3
                                  __ctype_b.symtab0x42a6644OBJECT<unknown>DEFAULT12
                                  __ctype_tolower.symtab0x42a7c44OBJECT<unknown>DEFAULT12
                                  __ctype_toupper.symtab0x42a6744OBJECT<unknown>DEFAULT12
                                  __curbrk.symtab0x431b604OBJECT<unknown>HIDDEN16
                                  __data_start.symtab0x42a5400OBJECT<unknown>DEFAULT12
                                  __decode_dotted.symtab0x412e20400FUNC<unknown>HIDDEN3
                                  __decode_header.symtab0x414b90228FUNC<unknown>HIDDEN3
                                  __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                  __dns_lookup.symtab0x412fb02608FUNC<unknown>HIDDEN3
                                  __do_global_ctors_aux.symtab0x4151600FUNC<unknown>DEFAULT3
                                  __do_global_dtors_aux.symtab0x4001800FUNC<unknown>DEFAULT3
                                  __dso_handle.symtab0x42ade00OBJECT<unknown>HIDDEN14
                                  __encode_dotted.symtab0x415020316FUNC<unknown>HIDDEN3
                                  __encode_header.symtab0x414a70276FUNC<unknown>HIDDEN3
                                  __encode_question.symtab0x414c80172FUNC<unknown>HIDDEN3
                                  __environ.symtab0x42f5e44OBJECT<unknown>DEFAULT16
                                  __errno_location.symtab0x40669028FUNC<unknown>DEFAULT3
                                  __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __exit_cleanup.symtab0x42f0804OBJECT<unknown>HIDDEN16
                                  __fcntl_nocancel.symtab0x406110108FUNC<unknown>DEFAULT3
                                  __fgetc_unlocked.symtab0x40fbb0388FUNC<unknown>DEFAULT3
                                  __fini_array_end.symtab0x42a0440NOTYPE<unknown>HIDDEN7
                                  __fini_array_start.symtab0x42a0440NOTYPE<unknown>HIDDEN7
                                  __fork.symtab0x40b250988FUNC<unknown>DEFAULT3
                                  __fork_generation_pointer.symtab0x42adec4OBJECT<unknown>HIDDEN15
                                  __fork_handlers.symtab0x42adf04OBJECT<unknown>HIDDEN15
                                  __fork_lock.symtab0x42f0904OBJECT<unknown>HIDDEN16
                                  __get_hosts_byname_r.symtab0x414200104FUNC<unknown>HIDDEN3
                                  __getdents64.symtab0x411af0436FUNC<unknown>HIDDEN3
                                  __getpagesize.symtab0x40cac048FUNC<unknown>DEFAULT3
                                  __getpid.symtab0x40b85084FUNC<unknown>DEFAULT3
                                  __glibc_strerror_r.symtab0x40844068FUNC<unknown>DEFAULT3
                                  __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __h_errno_location.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                  __init_array_end.symtab0x42a0440NOTYPE<unknown>HIDDEN7
                                  __init_array_start.symtab0x42a0440NOTYPE<unknown>HIDDEN7
                                  __libc_close.symtab0x40bc1c176FUNC<unknown>DEFAULT3
                                  __libc_connect.symtab0x40896c220FUNC<unknown>DEFAULT3
                                  __libc_disable_asynccancel.symtab0x40c0d0136FUNC<unknown>HIDDEN3
                                  __libc_enable_asynccancel.symtab0x40c158220FUNC<unknown>HIDDEN3
                                  __libc_errno.symtab0x04TLS<unknown>HIDDEN7
                                  __libc_fcntl.symtab0x40617c268FUNC<unknown>DEFAULT3
                                  __libc_fork.symtab0x40b250988FUNC<unknown>DEFAULT3
                                  __libc_h_errno.symtab0x44TLS<unknown>HIDDEN7
                                  __libc_nanosleep.symtab0x40cbbc200FUNC<unknown>DEFAULT3
                                  __libc_open.symtab0x40bd0c192FUNC<unknown>DEFAULT3
                                  __libc_read.symtab0x40bf0c192FUNC<unknown>DEFAULT3
                                  __libc_recv.symtab0x408b2c240FUNC<unknown>DEFAULT3
                                  __libc_select.symtab0x4064c0260FUNC<unknown>DEFAULT3
                                  __libc_send.symtab0x408c5c240FUNC<unknown>DEFAULT3
                                  __libc_setup_tls.symtab0x4113d8660FUNC<unknown>DEFAULT3
                                  __libc_sigaction.symtab0x40c93028FUNC<unknown>DEFAULT3
                                  __libc_stack_end.symtab0x42f5e04OBJECT<unknown>DEFAULT16
                                  __libc_waitpid.symtab0x40c00c192FUNC<unknown>DEFAULT3
                                  __libc_write.symtab0x40be0c192FUNC<unknown>DEFAULT3
                                  __linkin_atfork.symtab0x40b63080FUNC<unknown>HIDDEN3
                                  __lll_lock_wait_private.symtab0x40bb60120FUNC<unknown>HIDDEN3
                                  __local_nameserver.symtab0x4191d016OBJECT<unknown>HIDDEN5
                                  __malloc_consolidate.symtab0x409bf4520FUNC<unknown>HIDDEN3
                                  __malloc_largebin_index.symtab0x408f70140FUNC<unknown>DEFAULT3
                                  __malloc_lock.symtab0x42a69024OBJECT<unknown>DEFAULT12
                                  __malloc_state.symtab0x431c00888OBJECT<unknown>DEFAULT16
                                  __malloc_trim.symtab0x409ad0292FUNC<unknown>DEFAULT3
                                  __nameserver.symtab0x42ae244OBJECT<unknown>HIDDEN15
                                  __nameservers.symtab0x42ae284OBJECT<unknown>HIDDEN15
                                  __nptl_deallocate_tsd.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                  __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                  __open.symtab0x40bd0c192FUNC<unknown>DEFAULT3
                                  __open_etc_hosts.symtab0x414d3032FUNC<unknown>HIDDEN3
                                  __open_nameservers.symtab0x413ab01636FUNC<unknown>HIDDEN3
                                  __open_nocancel.symtab0x40bce440FUNC<unknown>DEFAULT3
                                  __pagesize.symtab0x42f5e84OBJECT<unknown>DEFAULT16
                                  __preinit_array_end.symtab0x42a0440NOTYPE<unknown>HIDDEN7
                                  __preinit_array_start.symtab0x42a0440NOTYPE<unknown>HIDDEN7
                                  __progname.symtab0x42a7b44OBJECT<unknown>DEFAULT12
                                  __progname_full.symtab0x42a7b84OBJECT<unknown>DEFAULT12
                                  __pthread_initialize_minimal.symtab0x41166c28FUNC<unknown>DEFAULT3
                                  __pthread_mutex_init.symtab0x40c2488FUNC<unknown>DEFAULT3
                                  __pthread_mutex_lock.symtab0x40c2408FUNC<unknown>DEFAULT3
                                  __pthread_mutex_trylock.symtab0x40c2408FUNC<unknown>DEFAULT3
                                  __pthread_mutex_unlock.symtab0x40c2408FUNC<unknown>DEFAULT3
                                  __pthread_return_0.symtab0x40c2408FUNC<unknown>DEFAULT3
                                  __pthread_unwind.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                  __read.symtab0x40bf0c192FUNC<unknown>DEFAULT3
                                  __read_etc_hosts_r.symtab0x414d50720FUNC<unknown>HIDDEN3
                                  __read_nocancel.symtab0x40bee440FUNC<unknown>DEFAULT3
                                  __register_atfork.symtab0x40b680452FUNC<unknown>DEFAULT3
                                  __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                  __res_sync.symtab0x42ae1c4OBJECT<unknown>HIDDEN15
                                  __resolv_attempts.symtab0x42a8f11OBJECT<unknown>HIDDEN12
                                  __resolv_lock.symtab0x431b8024OBJECT<unknown>DEFAULT16
                                  __resolv_timeout.symtab0x42a8f01OBJECT<unknown>HIDDEN12
                                  __rtld_fini.symtab0x42f5f04OBJECT<unknown>HIDDEN16
                                  __searchdomain.symtab0x42ae204OBJECT<unknown>HIDDEN15
                                  __searchdomains.symtab0x42ae2c4OBJECT<unknown>HIDDEN15
                                  __sigaddset.symtab0x408f0844FUNC<unknown>DEFAULT3
                                  __sigdelset.symtab0x408f3448FUNC<unknown>DEFAULT3
                                  __sigismember.symtab0x408ee040FUNC<unknown>DEFAULT3
                                  __sigjmp_save.symtab0x41464096FUNC<unknown>HIDDEN3
                                  __sigsetjmp.symtab0x40c97036FUNC<unknown>DEFAULT3
                                  __sigsetjmp_aux.symtab0x4117a0128FUNC<unknown>DEFAULT3
                                  __start.symtab0x4002d0100FUNC<unknown>DEFAULT3
                                  __stdin.symtab0x42a7ec4OBJECT<unknown>DEFAULT12
                                  __stdio_READ.symtab0x411f00144FUNC<unknown>HIDDEN3
                                  __stdio_WRITE.symtab0x411f90344FUNC<unknown>HIDDEN3
                                  __stdio_adjust_position.symtab0x4120f0256FUNC<unknown>HIDDEN3
                                  __stdio_fwrite.symtab0x40e230472FUNC<unknown>HIDDEN3
                                  __stdio_rfill.symtab0x4121f088FUNC<unknown>HIDDEN3
                                  __stdio_seek.symtab0x412330112FUNC<unknown>HIDDEN3
                                  __stdio_trans2r_o.symtab0x412250220FUNC<unknown>HIDDEN3
                                  __stdio_trans2w_o.symtab0x40e670304FUNC<unknown>HIDDEN3
                                  __stdio_wcommit.symtab0x40e7a0100FUNC<unknown>HIDDEN3
                                  __stdout.symtab0x42a7f04OBJECT<unknown>DEFAULT12
                                  __sys_connect.symtab0x40893060FUNC<unknown>DEFAULT3
                                  __sys_recv.symtab0x408af060FUNC<unknown>DEFAULT3
                                  __sys_send.symtab0x408c2060FUNC<unknown>DEFAULT3
                                  __syscall_error.symtab0x40c9a092FUNC<unknown>DEFAULT3
                                  __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __syscall_nanosleep.symtab0x40cb8060FUNC<unknown>DEFAULT3
                                  __syscall_poll.symtab0x41476060FUNC<unknown>DEFAULT3
                                  __syscall_rt_sigaction.symtab0x40ca0060FUNC<unknown>DEFAULT3
                                  __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __syscall_select.symtab0x40646096FUNC<unknown>DEFAULT3
                                  __tls_get_addr.symtab0x4113b832FUNC<unknown>DEFAULT3
                                  __uClibc_fini.symtab0x40c280204FUNC<unknown>DEFAULT3
                                  __uClibc_init.symtab0x40c3d4120FUNC<unknown>DEFAULT3
                                  __uClibc_main.symtab0x40c44c1132FUNC<unknown>DEFAULT3
                                  __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __uclibc_progname.symtab0x42a7b04OBJECT<unknown>HIDDEN12
                                  __waitpid.symtab0x40c00c192FUNC<unknown>DEFAULT3
                                  __waitpid_nocancel.symtab0x40bfe440FUNC<unknown>DEFAULT3
                                  __write.symtab0x40be0c192FUNC<unknown>DEFAULT3
                                  __write_nocancel.symtab0x40bde440FUNC<unknown>DEFAULT3
                                  __xpg_strerror_r.symtab0x408490380FUNC<unknown>DEFAULT3
                                  __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  __xstat32_conv.symtab0x411a08220FUNC<unknown>HIDDEN3
                                  __xstat64_conv.symtab0x411910248FUNC<unknown>HIDDEN3
                                  _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _bss_custom_printf_spec.symtab0x42ee7010OBJECT<unknown>DEFAULT16
                                  _charpad.symtab0x406800156FUNC<unknown>DEFAULT3
                                  _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _custom_printf_arginfo.symtab0x431ba040OBJECT<unknown>HIDDEN16
                                  _custom_printf_handler.symtab0x431bc840OBJECT<unknown>HIDDEN16
                                  _custom_printf_spec.symtab0x42a6804OBJECT<unknown>HIDDEN12
                                  _dl_aux_init.symtab0x41169040FUNC<unknown>DEFAULT3
                                  _dl_init_static_tls.symtab0x42a8d04OBJECT<unknown>DEFAULT12
                                  _dl_nothread_init_static_tls.symtab0x4116b8148FUNC<unknown>HIDDEN3
                                  _dl_phdr.symtab0x42ae144OBJECT<unknown>DEFAULT15
                                  _dl_phnum.symtab0x42ae184OBJECT<unknown>DEFAULT15
                                  _dl_tls_dtv_gaps.symtab0x42ae081OBJECT<unknown>DEFAULT15
                                  _dl_tls_dtv_slotinfo_list.symtab0x42ae044OBJECT<unknown>DEFAULT15
                                  _dl_tls_generation.symtab0x42ae0c4OBJECT<unknown>DEFAULT15
                                  _dl_tls_max_dtv_idx.symtab0x42adfc4OBJECT<unknown>DEFAULT15
                                  _dl_tls_setup.symtab0x411354100FUNC<unknown>DEFAULT3
                                  _dl_tls_static_align.symtab0x42adf84OBJECT<unknown>DEFAULT15
                                  _dl_tls_static_nelem.symtab0x42ae104OBJECT<unknown>DEFAULT15
                                  _dl_tls_static_size.symtab0x42ae004OBJECT<unknown>DEFAULT15
                                  _dl_tls_static_used.symtab0x42adf44OBJECT<unknown>DEFAULT15
                                  _edata.symtab0x42ade40NOTYPE<unknown>DEFAULTSHN_ABS
                                  _end.symtab0x431f780NOTYPE<unknown>DEFAULTSHN_ABS
                                  _exit.symtab0x40629076FUNC<unknown>DEFAULT3
                                  _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _fbss.symtab0x42ade40NOTYPE<unknown>DEFAULTSHN_ABS
                                  _fdata.symtab0x42a5300NOTYPE<unknown>DEFAULT12
                                  _fini.symtab0x4151d028FUNC<unknown>DEFAULT4
                                  _fixed_buffers.symtab0x42f6208192OBJECT<unknown>DEFAULT16
                                  _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _fp_out_narrow.symtab0x40689c232FUNC<unknown>DEFAULT3
                                  _fpmaxtostr.symtab0x40ea402156FUNC<unknown>HIDDEN3
                                  _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _ftext.symtab0x4001800NOTYPE<unknown>DEFAULT3
                                  _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _gp.symtab0x4328f00NOTYPE<unknown>DEFAULTSHN_ABS
                                  _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                  _init.symtab0x4000ec28FUNC<unknown>DEFAULT2
                                  _load_inttype.symtab0x40e810136FUNC<unknown>HIDDEN3
                                  _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _ppfs_init.symtab0x407220248FUNC<unknown>HIDDEN3
                                  _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _ppfs_parsespec.symtab0x40762c1684FUNC<unknown>HIDDEN3
                                  _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _ppfs_prepargs.symtab0x407320100FUNC<unknown>HIDDEN3
                                  _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _ppfs_setargs.symtab0x407390548FUNC<unknown>HIDDEN3
                                  _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _promoted_size.symtab0x4075c0108FUNC<unknown>DEFAULT3
                                  _pthread_cleanup_pop_restore.symtab0x40c25c36FUNC<unknown>DEFAULT3
                                  _pthread_cleanup_push_defer.symtab0x40c25012FUNC<unknown>DEFAULT3
                                  _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _setjmp.symtab0x40c95028FUNC<unknown>DEFAULT3
                                  _sigintr.symtab0x431bf016OBJECT<unknown>HIDDEN16
                                  _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _stdio_fopen.symtab0x40dda01168FUNC<unknown>HIDDEN3
                                  _stdio_init.symtab0x40e410184FUNC<unknown>HIDDEN3
                                  _stdio_openlist.symtab0x42a7f44OBJECT<unknown>DEFAULT12
                                  _stdio_openlist_add_lock.symtab0x42f60012OBJECT<unknown>DEFAULT16
                                  _stdio_openlist_dec_use.symtab0x40f570648FUNC<unknown>HIDDEN3
                                  _stdio_openlist_del_count.symtab0x42f61c4OBJECT<unknown>DEFAULT16
                                  _stdio_openlist_del_lock.symtab0x42f60c12OBJECT<unknown>DEFAULT16
                                  _stdio_openlist_use_count.symtab0x42f6184OBJECT<unknown>DEFAULT16
                                  _stdio_streams.symtab0x42a7f8204OBJECT<unknown>DEFAULT12
                                  _stdio_term.symtab0x40e4c8416FUNC<unknown>HIDDEN3
                                  _stdio_user_locking.symtab0x42a7d04OBJECT<unknown>DEFAULT12
                                  _stdlib_strto_l.symtab0x40aa50488FUNC<unknown>HIDDEN3
                                  _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _store_inttype.symtab0x40e8a068FUNC<unknown>HIDDEN3
                                  _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _string_syserrmsgs.symtab0x417d302934OBJECT<unknown>HIDDEN5
                                  _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _uintmaxtostr.symtab0x40e8f0332FUNC<unknown>HIDDEN3
                                  _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _vfprintf_internal.symtab0x4069842204FUNC<unknown>HIDDEN3
                                  _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  abort.symtab0x40a0f0408FUNC<unknown>DEFAULT3
                                  abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  atoi.symtab0x40aa1028FUNC<unknown>DEFAULT3
                                  atol.symtab0x40aa1028FUNC<unknown>DEFAULT3
                                  atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  bcopy.symtab0x40861032FUNC<unknown>DEFAULT3
                                  bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  been_there_done_that.symtab0x42f0704OBJECT<unknown>DEFAULT16
                                  bot.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  brk.symtab0x41175080FUNC<unknown>DEFAULT3
                                  brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  bsd_signal.symtab0x408df0228FUNC<unknown>DEFAULT3
                                  buf.4511.symtab0x42ee9016OBJECT<unknown>DEFAULT16
                                  buf.6560.symtab0x42eea0440OBJECT<unknown>DEFAULT16
                                  bzero.symtab0x40863028FUNC<unknown>DEFAULT3
                                  bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  c.symtab0x42a5544OBJECT<unknown>DEFAULT12
                                  calloc.symtab0x410d20344FUNC<unknown>DEFAULT3
                                  calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  chdir.symtab0x4062e056FUNC<unknown>DEFAULT3
                                  chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  close.symtab0x40bc1c176FUNC<unknown>DEFAULT3
                                  closedir.symtab0x40cdf0292FUNC<unknown>DEFAULT3
                                  closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  closenameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  commServer.symtab0x42a5604OBJECT<unknown>DEFAULT12
                                  completed.4786.symtab0x42ae301OBJECT<unknown>DEFAULT16
                                  connect.symtab0x40896c220FUNC<unknown>DEFAULT3
                                  connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  connectTimeout.symtab0x401e10828FUNC<unknown>DEFAULT3
                                  crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  currentServer.symtab0x42a5504OBJECT<unknown>DEFAULT12
                                  data_start.symtab0x42a5400OBJECT<unknown>DEFAULT12
                                  decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  dns.symtab0x42a5644OBJECT<unknown>DEFAULT12
                                  dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  environ.symtab0x42f5e44OBJECT<unknown>DEFAULT16
                                  errno.symtab0x04TLS<unknown>DEFAULT7
                                  errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  estridx.symtab0x417ca0126OBJECT<unknown>DEFAULT5
                                  exit.symtab0x40ac40240FUNC<unknown>DEFAULT3
                                  exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  exp10_table.symtab0x4190a872OBJECT<unknown>DEFAULT5
                                  fclose.symtab0x40da50804FUNC<unknown>DEFAULT3
                                  fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fcntl.symtab0x40617c268FUNC<unknown>DEFAULT3
                                  fd_to_DIR.symtab0x40cf20276FUNC<unknown>DEFAULT3
                                  fdgets.symtab0x4006f0292FUNC<unknown>DEFAULT3
                                  fdopendir.symtab0x40d124228FUNC<unknown>DEFAULT3
                                  fflush_unlocked.symtab0x40f7f8940FUNC<unknown>DEFAULT3
                                  fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fgetc.symtab0x40f2b0372FUNC<unknown>DEFAULT3
                                  fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fgetc_unlocked.symtab0x40fbb0388FUNC<unknown>DEFAULT3
                                  fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fgets.symtab0x40f430320FUNC<unknown>DEFAULT3
                                  fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fgets_unlocked.symtab0x40fd40276FUNC<unknown>DEFAULT3
                                  fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fmt.symtab0x41909020OBJECT<unknown>DEFAULT5
                                  fopen.symtab0x40dd8028FUNC<unknown>DEFAULT3
                                  fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fork.symtab0x40b250988FUNC<unknown>DEFAULT3
                                  fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fork_handler_pool.symtab0x42f0941348OBJECT<unknown>DEFAULT16
                                  fputs_unlocked.symtab0x407cc0124FUNC<unknown>DEFAULT3
                                  fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  frame_dummy.symtab0x40023c0FUNC<unknown>DEFAULT3
                                  free.symtab0x409dfc660FUNC<unknown>DEFAULT3
                                  free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fseek.symtab0x411cb068FUNC<unknown>DEFAULT3
                                  fseeko.symtab0x411cb068FUNC<unknown>DEFAULT3
                                  fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fseeko64.symtab0x411d00500FUNC<unknown>DEFAULT3
                                  fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fstat.symtab0x411820136FUNC<unknown>DEFAULT3
                                  fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  fwrite_unlocked.symtab0x407d40268FUNC<unknown>DEFAULT3
                                  fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getArch.symtab0x4041cc56FUNC<unknown>DEFAULT3
                                  getHost.symtab0x401a04160FUNC<unknown>DEFAULT3
                                  getOurIP.symtab0x400814904FUNC<unknown>DEFAULT3
                                  getRandomIP.symtab0x400644172FUNC<unknown>DEFAULT3
                                  get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getc.symtab0x40f2b0372FUNC<unknown>DEFAULT3
                                  getc_unlocked.symtab0x40fbb0388FUNC<unknown>DEFAULT3
                                  getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getdtablesize.symtab0x40ca4072FUNC<unknown>DEFAULT3
                                  getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getegid.symtab0x40ca9016FUNC<unknown>DEFAULT3
                                  getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  geteuid.symtab0x40caa016FUNC<unknown>DEFAULT3
                                  geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getgid.symtab0x40cab016FUNC<unknown>DEFAULT3
                                  getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  gethostbyname.symtab0x4088a028FUNC<unknown>DEFAULT3
                                  gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  gethostbyname2.symtab0x4088c0104FUNC<unknown>DEFAULT3
                                  gethostbyname2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  gethostbyname2_r.symtab0x410960948FUNC<unknown>DEFAULT3
                                  gethostbyname2_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  gethostbyname_r.symtab0x414270968FUNC<unknown>DEFAULT3
                                  gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  gethostname.symtab0x4146a0192FUNC<unknown>DEFAULT3
                                  gethostname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getpagesize.symtab0x40cac048FUNC<unknown>DEFAULT3
                                  getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getpid.symtab0x40b85084FUNC<unknown>DEFAULT3
                                  getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getrlimit.symtab0x40caf060FUNC<unknown>DEFAULT3
                                  getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getsockname.symtab0x408a5060FUNC<unknown>DEFAULT3
                                  getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getsockopt.symtab0x408a9096FUNC<unknown>DEFAULT3
                                  getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  getuid.symtab0x40cb3016FUNC<unknown>DEFAULT3
                                  getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  h_errno.symtab0x44TLS<unknown>DEFAULT7
                                  hlt.symtab0x40032c0NOTYPE<unknown>DEFAULT3
                                  hoste.6559.symtab0x42f05820OBJECT<unknown>DEFAULT16
                                  htonl.symtab0x4086f840FUNC<unknown>DEFAULT3
                                  htons.symtab0x4086e024FUNC<unknown>DEFAULT3
                                  i.4697.symtab0x42a5584OBJECT<unknown>DEFAULT12
                                  index.symtab0x408020248FUNC<unknown>DEFAULT3
                                  inet_addr.symtab0x40885072FUNC<unknown>DEFAULT3
                                  inet_aton.symtab0x410840284FUNC<unknown>DEFAULT3
                                  inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  inet_ntoa.symtab0x40882c32FUNC<unknown>DEFAULT3
                                  inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  inet_ntoa_r.symtab0x408760204FUNC<unknown>DEFAULT3
                                  inet_ntop.symtab0x412acc852FUNC<unknown>DEFAULT3
                                  inet_ntop4.symtab0x412910444FUNC<unknown>DEFAULT3
                                  inet_pton.symtab0x412658696FUNC<unknown>DEFAULT3
                                  inet_pton4.symtab0x412570232FUNC<unknown>DEFAULT3
                                  initConnection.symtab0x4052ac592FUNC<unknown>DEFAULT3
                                  init_rand.symtab0x400340300FUNC<unknown>DEFAULT3
                                  init_static_tls.symtab0x41130084FUNC<unknown>DEFAULT3
                                  initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  initstate.symtab0x40a40c208FUNC<unknown>DEFAULT3
                                  initstate_r.symtab0x40a7cc300FUNC<unknown>DEFAULT3
                                  ioctl.symtab0x406320248FUNC<unknown>DEFAULT3
                                  ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  isatty.symtab0x41075060FUNC<unknown>DEFAULT3
                                  isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  isspace.symtab0x40662044FUNC<unknown>DEFAULT3
                                  isspace.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  kill.symtab0x40642056FUNC<unknown>DEFAULT3
                                  kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  last_id.6617.symtab0x42a8e02OBJECT<unknown>DEFAULT12
                                  last_ns_num.6616.symtab0x431b704OBJECT<unknown>DEFAULT16
                                  libc-cancellation.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  libc-lowlevellock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  libc-tls.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  listFork.symtab0x40214c664FUNC<unknown>DEFAULT3
                                  llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  lseek64.symtab0x414950136FUNC<unknown>DEFAULT3
                                  macAddress.symtab0x42ae606OBJECT<unknown>DEFAULT16
                                  main.symtab0x4054fc3080FUNC<unknown>DEFAULT3
                                  mainCommSock.symtab0x42ae504OBJECT<unknown>DEFAULT16
                                  malloc.symtab0x408ffc2764FUNC<unknown>DEFAULT3
                                  malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  malloc_trim.symtab0x40a09084FUNC<unknown>DEFAULT3
                                  memchr.symtab0x40fe60260FUNC<unknown>DEFAULT3
                                  memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  memcpy.symtab0x407e50308FUNC<unknown>DEFAULT3
                                  memmove.symtab0x40ff70824FUNC<unknown>DEFAULT3
                                  memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  mempcpy.symtab0x4123a076FUNC<unknown>DEFAULT3
                                  mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  memrchr.symtab0x4102b0260FUNC<unknown>DEFAULT3
                                  memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  memset.symtab0x407f90144FUNC<unknown>DEFAULT3
                                  mmap.symtab0x40c8c0112FUNC<unknown>DEFAULT3
                                  mmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  mremap.symtab0x4118b096FUNC<unknown>DEFAULT3
                                  mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  munmap.symtab0x40cb4060FUNC<unknown>DEFAULT3
                                  munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  mylock.symtab0x42a6b024OBJECT<unknown>DEFAULT12
                                  mylock.symtab0x42a6d024OBJECT<unknown>DEFAULT12
                                  nanosleep.symtab0x40cbbc200FUNC<unknown>DEFAULT3
                                  nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  next_start.1303.symtab0x42ee804OBJECT<unknown>DEFAULT16
                                  nprocessors_onln.symtab0x40ad30508FUNC<unknown>DEFAULT3
                                  ntohl.symtab0x40873840FUNC<unknown>DEFAULT3
                                  ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  ntohs.symtab0x40872024FUNC<unknown>DEFAULT3
                                  ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  numpids.symtab0x42ae588OBJECT<unknown>DEFAULT16
                                  object.4798.symtab0x42ae3424OBJECT<unknown>DEFAULT16
                                  open.symtab0x40bd0c192FUNC<unknown>DEFAULT3
                                  opendir.symtab0x40d034240FUNC<unknown>DEFAULT3
                                  opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  ourIP.symtab0x42ade44OBJECT<unknown>DEFAULT15
                                  ovhl7.symtab0x402f384756FUNC<unknown>DEFAULT3
                                  p.4784.symtab0x42a5300OBJECT<unknown>DEFAULT12
                                  parse_config.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  pids.symtab0x42ade84OBJECT<unknown>DEFAULT15
                                  poll.symtab0x41479c220FUNC<unknown>DEFAULT3
                                  poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  prefix.6318.symtab0x417bf012OBJECT<unknown>DEFAULT5
                                  print.symtab0x4012f81460FUNC<unknown>DEFAULT3
                                  printchar.symtab0x400d68184FUNC<unknown>DEFAULT3
                                  printi.symtab0x40105c668FUNC<unknown>DEFAULT3
                                  prints.symtab0x400e20572FUNC<unknown>DEFAULT3
                                  processCmd.symtab0x4042044264FUNC<unknown>DEFAULT3
                                  program_invocation_name.symtab0x42a7b84OBJECT<unknown>DEFAULT12
                                  program_invocation_short_name.symtab0x42a7b44OBJECT<unknown>DEFAULT12
                                  qual_chars.6326.symtab0x417c1020OBJECT<unknown>DEFAULT5
                                  raise.symtab0x40b8b0264FUNC<unknown>DEFAULT3
                                  raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  rand.symtab0x40a29028FUNC<unknown>DEFAULT3
                                  rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  rand_cmwc.symtab0x40046c472FUNC<unknown>DEFAULT3
                                  random.symtab0x40a2b0164FUNC<unknown>DEFAULT3
                                  random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  random_poly_info.symtab0x4188b040OBJECT<unknown>DEFAULT5
                                  random_r.symtab0x40a590172FUNC<unknown>DEFAULT3
                                  random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  randtbl.symtab0x42a6e8128OBJECT<unknown>DEFAULT12
                                  rawmemchr.symtab0x4123f0192FUNC<unknown>DEFAULT3
                                  rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  read.symtab0x40bf0c192FUNC<unknown>DEFAULT3
                                  read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  readdir64.symtab0x40d210272FUNC<unknown>DEFAULT3
                                  readdir64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  realloc.symtab0x410e801152FUNC<unknown>DEFAULT3
                                  realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  recv.symtab0x408b2c240FUNC<unknown>DEFAULT3
                                  recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  recvLine.symtab0x401aa4876FUNC<unknown>DEFAULT3
                                  register-atfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  resolv_conf_mtime.6599.symtab0x431b984OBJECT<unknown>DEFAULT16
                                  rindex.symtab0x410550160FUNC<unknown>DEFAULT3
                                  sbrk.symtab0x40cc90164FUNC<unknown>DEFAULT3
                                  sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  select.symtab0x4064c0260FUNC<unknown>DEFAULT3
                                  select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  send.symtab0x408c5c240FUNC<unknown>DEFAULT3
                                  send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  setjmp_aux.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  setsid.symtab0x4065d060FUNC<unknown>DEFAULT3
                                  setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  setsockopt.symtab0x408d5096FUNC<unknown>DEFAULT3
                                  setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  setstate.symtab0x40a354184FUNC<unknown>DEFAULT3
                                  setstate_r.symtab0x40a8f8272FUNC<unknown>DEFAULT3
                                  sigaction.symtab0x40c93028FUNC<unknown>DEFAULT3
                                  sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  sigjmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  signal.symtab0x408df0228FUNC<unknown>DEFAULT3
                                  signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  sigprocmask.symtab0x40cd40176FUNC<unknown>DEFAULT3
                                  sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  skip_and_NUL_space.symtab0x413a48104FUNC<unknown>DEFAULT3
                                  skip_nospace.symtab0x4139e0104FUNC<unknown>DEFAULT3
                                  sleep.symtab0x40b9c0404FUNC<unknown>DEFAULT3
                                  sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  socket.symtab0x408db060FUNC<unknown>DEFAULT3
                                  socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  socket_connect.symtab0x4023e4444FUNC<unknown>DEFAULT3
                                  sockprintf.symtab0x4018ac344FUNC<unknown>DEFAULT3
                                  spec_and_mask.6325.symtab0x417c2416OBJECT<unknown>DEFAULT5
                                  spec_base.6317.symtab0x417bfc7OBJECT<unknown>DEFAULT5
                                  spec_chars.6322.symtab0x417c8021OBJECT<unknown>DEFAULT5
                                  spec_flags.6321.symtab0x417c988OBJECT<unknown>DEFAULT5
                                  spec_or_mask.6324.symtab0x417c3416OBJECT<unknown>DEFAULT5
                                  spec_ranges.6323.symtab0x417c449OBJECT<unknown>DEFAULT5
                                  sprintf.symtab0x4066b080FUNC<unknown>DEFAULT3
                                  sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  srand.symtab0x40a4dc172FUNC<unknown>DEFAULT3
                                  srandom.symtab0x40a4dc172FUNC<unknown>DEFAULT3
                                  srandom_r.symtab0x40a63c400FUNC<unknown>DEFAULT3
                                  stat.symtab0x414880136FUNC<unknown>DEFAULT3
                                  stat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  static_dtv.symtab0x431620512OBJECT<unknown>DEFAULT16
                                  static_map.symtab0x431b2852OBJECT<unknown>DEFAULT16
                                  static_slotinfo.symtab0x431820776OBJECT<unknown>DEFAULT16
                                  stderr.symtab0x42a7e84OBJECT<unknown>DEFAULT12
                                  stdin.symtab0x42a7e04OBJECT<unknown>DEFAULT12
                                  stdout.symtab0x42a7e44OBJECT<unknown>DEFAULT12
                                  strcasecmp.symtab0x408650108FUNC<unknown>DEFAULT3
                                  strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strchr.symtab0x408020248FUNC<unknown>DEFAULT3
                                  strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strchrnul.symtab0x4103c0248FUNC<unknown>DEFAULT3
                                  strchrnul.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strcmp.symtab0x40812044FUNC<unknown>DEFAULT3
                                  strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strcoll.symtab0x40812044FUNC<unknown>DEFAULT3
                                  strcpy.symtab0x40815036FUNC<unknown>DEFAULT3
                                  strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strcspn.symtab0x4104c0144FUNC<unknown>DEFAULT3
                                  strcspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strdup.symtab0x4149e0140FUNC<unknown>DEFAULT3
                                  strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strerror_r.symtab0x408490380FUNC<unknown>DEFAULT3
                                  strlen.symtab0x408180184FUNC<unknown>DEFAULT3
                                  strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strncpy.symtab0x4124b0188FUNC<unknown>DEFAULT3
                                  strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strnlen.symtab0x408240248FUNC<unknown>DEFAULT3
                                  strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strpbrk.symtab0x41071064FUNC<unknown>DEFAULT3
                                  strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strrchr.symtab0x410550160FUNC<unknown>DEFAULT3
                                  strrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strspn.symtab0x4105f072FUNC<unknown>DEFAULT3
                                  strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strstr.symtab0x408340256FUNC<unknown>DEFAULT3
                                  strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strtok.symtab0x4086c032FUNC<unknown>DEFAULT3
                                  strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strtok_r.symtab0x410640208FUNC<unknown>DEFAULT3
                                  strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  strtol.symtab0x40aa3028FUNC<unknown>DEFAULT3
                                  strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  sysconf.symtab0x40af2c792FUNC<unknown>DEFAULT3
                                  sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  tcgetattr.symtab0x410790176FUNC<unknown>DEFAULT3
                                  tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  time.symtab0x40661016FUNC<unknown>DEFAULT3
                                  time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  toupper.symtab0x40665060FUNC<unknown>DEFAULT3
                                  toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  trim.symtab0x400b9c460FUNC<unknown>DEFAULT3
                                  type_codes.symtab0x417c5024OBJECT<unknown>DEFAULT5
                                  type_sizes.symtab0x417c6812OBJECT<unknown>DEFAULT5
                                  uname.symtab0x41491060FUNC<unknown>DEFAULT3
                                  uname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  unknown.1327.symtab0x417d2014OBJECT<unknown>DEFAULT5
                                  unsafe_state.symtab0x42a77020OBJECT<unknown>DEFAULT12
                                  useragents.symtab0x42a568236OBJECT<unknown>DEFAULT12
                                  vsnprintf.symtab0x406700248FUNC<unknown>DEFAULT3
                                  vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  waitpid.symtab0x40c00c192FUNC<unknown>DEFAULT3
                                  wcrtomb.symtab0x40d8e0108FUNC<unknown>DEFAULT3
                                  wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  wcsnrtombs.symtab0x40d990192FUNC<unknown>DEFAULT3
                                  wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  wcsrtombs.symtab0x40d95064FUNC<unknown>DEFAULT3
                                  wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  write.symtab0x40be0c192FUNC<unknown>DEFAULT3
                                  xdigits.4935.symtab0x41916417OBJECT<unknown>DEFAULT5
                                  xstatconv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                  xtdcustom.symtab0x402850536FUNC<unknown>DEFAULT3

                                  Download Network PCAP: filteredfull

                                  • Total Packets: 63
                                  • 4258 undefined
                                  • 53 (DNS)
                                  TimestampSource PortDest PortSource IPDest IP
                                  Mar 27, 2025 01:18:18.488681078 CET487084258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:18.714353085 CET425848708213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:18.714422941 CET487084258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:18.716137886 CET487084258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:18.940149069 CET425848708213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:18.940165997 CET425848708213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:18.940371990 CET487084258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:18.941339970 CET487084258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:18.941875935 CET425848708213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:18.941953897 CET487104258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.166002035 CET425848708213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.166990042 CET425848708213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.188076973 CET425848710213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.188287973 CET487104258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.188472033 CET487104258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.434667110 CET425848710213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.434720039 CET425848710213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.434752941 CET425848710213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.434917927 CET487104258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.434919119 CET487104258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.436028957 CET487124258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.660372019 CET425848712213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.660599947 CET487124258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.660599947 CET487124258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.681375027 CET425848710213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.681410074 CET425848710213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.885112047 CET425848712213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.885133028 CET425848712213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.885148048 CET425848712213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:19.885237932 CET487124258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:19.887907028 CET487144258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.109582901 CET425848712213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.113187075 CET425848714213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.113312960 CET487144258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.113382101 CET487144258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.338449001 CET425848714213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.338563919 CET425848714213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.338598013 CET425848714213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.339138031 CET487144258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.339338064 CET487164258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.564280033 CET425848714213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.564321995 CET425848716213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.564426899 CET487164258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.564503908 CET487164258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.791605949 CET425848716213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.791662931 CET425848716213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.791697979 CET425848716213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:20.791750908 CET487164258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:20.792711973 CET487184258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.016649008 CET425848716213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.016865015 CET425848718213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.017007113 CET487184258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.017091036 CET487184258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.241586924 CET425848718213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.241717100 CET425848718213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.241755962 CET425848718213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.242001057 CET487184258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.242988110 CET487204258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.466605902 CET425848718213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.489562035 CET425848720213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.489778042 CET487204258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.489866018 CET487204258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.736645937 CET425848720213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.736660004 CET425848720213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.736669064 CET425848720213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.736776114 CET487204258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.737498999 CET487224258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.962445974 CET425848722213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:21.962558985 CET487224258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.962640047 CET487224258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:21.983268023 CET425848720213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.188640118 CET425848722213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.188657999 CET425848722213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.188673019 CET425848722213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.188688993 CET425848722213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.188749075 CET487224258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.189470053 CET487244258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.413794041 CET425848724213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.413813114 CET425848722213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.413906097 CET487244258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.413938046 CET487244258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.638267040 CET425848724213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.638298035 CET425848724213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.638314962 CET425848724213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.638391972 CET487244258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.639153957 CET487264258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.862600088 CET425848724213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.865036011 CET425848726213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:22.865149975 CET487264258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:22.865191936 CET487264258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.091209888 CET425848726213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.091242075 CET425848726213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.091253996 CET425848726213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.091264009 CET425848726213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.091423988 CET487264258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.091967106 CET487284258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.317190886 CET425848728213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.317418098 CET425848726213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.317414999 CET487284258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.317501068 CET487284258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.542850971 CET425848728213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.542890072 CET425848728213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.542922974 CET425848728213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.542964935 CET487284258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.543590069 CET487304258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.768153906 CET425848728213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.768623114 CET425848730213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.768846035 CET487304258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.768876076 CET487304258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.994004011 CET425848730213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.994019032 CET425848730213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.994028091 CET425848730213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:23.994323015 CET487304258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:23.995106936 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:24.219317913 CET425848730213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:24.242186069 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:24.242414951 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:24.242414951 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:24.489728928 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:37.458337069 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:37.458507061 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:18:37.705488920 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:18:37.705697060 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:19:37.458668947 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:19:37.458851099 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:19:37.705908060 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:19:37.706074953 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:20:37.459475040 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:20:37.459681988 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:20:37.706789017 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:20:37.708285093 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:21:37.460098028 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:21:37.460314035 CET487324258192.168.2.13213.152.43.231
                                  Mar 27, 2025 01:21:37.708444118 CET425848732213.152.43.231192.168.2.13
                                  Mar 27, 2025 01:21:37.708587885 CET487324258192.168.2.13213.152.43.231
                                  TimestampSource PortDest PortSource IPDest IP
                                  Mar 27, 2025 01:21:02.364571095 CET5704153192.168.2.131.1.1.1
                                  Mar 27, 2025 01:21:02.364571095 CET5574953192.168.2.131.1.1.1
                                  Mar 27, 2025 01:21:02.452949047 CET53570411.1.1.1192.168.2.13
                                  Mar 27, 2025 01:21:02.452965021 CET53557491.1.1.1192.168.2.13
                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Mar 27, 2025 01:21:02.364571095 CET192.168.2.131.1.1.10x27adStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                  Mar 27, 2025 01:21:02.364571095 CET192.168.2.131.1.1.10xfd0dStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Mar 27, 2025 01:21:02.452949047 CET1.1.1.1192.168.2.130x27adNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                  Mar 27, 2025 01:21:02.452949047 CET1.1.1.1192.168.2.130x27adNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                  System Behavior

                                  Start time (UTC):00:18:17
                                  Start date (UTC):27/03/2025
                                  Path:/tmp/hidakibest.mpsl.elf
                                  Arguments:/tmp/hidakibest.mpsl.elf
                                  File size:5773336 bytes
                                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                  Start time (UTC):00:18:17
                                  Start date (UTC):27/03/2025
                                  Path:/tmp/hidakibest.mpsl.elf
                                  Arguments:-
                                  File size:5773336 bytes
                                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                  Start time (UTC):00:18:17
                                  Start date (UTC):27/03/2025
                                  Path:/tmp/hidakibest.mpsl.elf
                                  Arguments:-
                                  File size:5773336 bytes
                                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9